What is the JSESSIONID cookie?
This is a strictly necessary session cookie generated by Java-based web servers to maintain user state and session data across multiple page requests.
Table of Contents
About JSESSIONID
| Vendor | Unknown |
|---|---|
| Category Category The functional category of the technology, such as Web Analytics or Social Media. Learn more | Heatmap & Recording |
| Consent Category Consent Category The consent category this cookie most commonly falls under across sites we scan, normalized into four standard categories. Learn more | Strictly Necessary |
| Prevalence | Very Common |
| Popularity Popularity Popularity is calculated from our dataset of 4.5B+ cookies analyzed across hundreds of millions of web pages. Learn more | Found on 18.9% of scanned pages |
| Expiration Type | Session |
| Party Type Party Type Whether the cookie is first-party or third-party. Learn more | Mixed |
| Risk Level Risk Level Rates how sensitive the data stored by this cookie is (High, Medium, or Low) based on data classification and distribution. Learn more | Low |
What is the purpose of JSESSIONID?
The JSESSIONID cookie is the default session identifier generated by Java Enterprise Edition (Java EE / Jakarta EE) compliant web application servers, such as Apache Tomcat, Oracle WebLogic, JBoss, and Spring Boot. It contains a unique, randomly generated string that the server uses to match an individual user's web browser to a session object stored in the server's memory. This mechanism allows the web application to maintain state and 'remember' information - such as user authentication status, shopping cart contents, or step-by-step form progress - as the user navigates between different pages on the site. Because HTTP is inherently a stateless protocol, session identifiers like JSESSIONID are essential for the core functionality of any interactive Java-based web application. The cookie itself does not contain any personal data, only the identifier string.
What are the Privacy Risks of JSESSIONID?
Risk Level: Low
The JSESSIONID cookie is an essential, anonymous identifier that contains only a randomly generated string. It does not store Personally Identifiable Information (PII) directly within the cookie, nor does it inherently track user behavior across different, unaffiliated websites (unless explicitly implemented as part of a third-party tracking network). Its primary risk is strictly limited to basic session hijacking if the cookie is not properly secured (e.g., missing the Secure or HttpOnly flags), but from a privacy perspective, it poses minimal risk.
How to Remove JSESSIONID from a Website
The JSESSIONID cookie is generated by the Java web server or application container (such as Tomcat, WebLogic, or JBoss) hosting the website's backend or third-party service endpoints. Because it is strictly necessary for maintaining user sessions, removing it will break session-dependent functionality like authenticated logins or multi-step forms. To remove this cookie, a site administrator must either disable session creation entirely in the Java application's configuration (for example, by setting allowSessionCreation to false in Spring Security or preventing the creation of HttpSession objects in servlets) or re-architect the application to use stateless authentication methods, such as passing JSON Web Tokens (JWT) in HTTP headers. If the cookie is set by a third-party Java-based service integrated on the site, the site owner must completely remove that third-party vendor's script or integration to stop the cookie from being set.