Is jSessionId really unique?

Question

To put some context, i'm developing an API to track user actions on the site (anon users too). So far, we use jsessionId to identify each user and his actions.

That API, now runs on Tomcat and JBoss.

The really matter question is, since we analize all data one a day, is in any way the uniqueness of this jsessionId guaranteed all along the day? Or, not concurrently, can other user get the same jsessionId used previously by other one?

Thanks in advance.

Answer 1

Sorry, it's not specified. It's only required to be unique for that jvm at that point in time. That is, session ids can be reused multiple times a day, as long as no one else has a session in place. I agree that most actual implementations might offer a stronger guarantee, but I don't think you can count on it.

Take a look at this mailing list - in it the people discuss session id reuse in both tomcat and resin.

So, basically the assumption the session ID is unique, is only true until the session gets destroyed.