HTTPSession id is not unique getSession(True)

[Karthik Rajendiran]

Hello Team,

HTTPSession Id is not returning new ids and try to reuse the same ids inspite of calling getSession(true)
on high load times.

session=request.getSession(false)
session.invalidate()
session = request.getSession(true)  // returns same id which was in step 1

[Jaikiran Pai]

Which version of JBoss AS or WildFly is this?

[Tim Holloway]

1. You shouldn't be concerning yourself with the actual session IDs. They belong to the SERVER, not to the webapp. And the server can and WILL change the jsessionId value when it wants to and without informing the web application.

2. getSession(true) does not unconditionally create a new session/sessionID. What it does, is check to see if a session was ALREADY created. If so, it returns that existing HttpSession object. Only if no HttpSession object already exists will a new session be created.