How is JSESSIONID going? As a header parameter or as a cookie parameter?

Question

After user authentication, subsequent requests from the user do not need to be re-authenticated. This is achieved using JSESSIONID.
But I'm not sure how the JSESSIONID goes? As a header field or as a cookie field. Or the application developer may choose one approach or another.

Can someone explain how this works when spring-security is used for authentication and authorization.

Answer 1

JSESSIONID , , . , JSESSIONID HttpServletRequest HttpServletResponse. , .

, .

- JSESSIONID, , , .

JSESSIONID, cookie, , cookie, , .

Answer 2

JSESSIONID - cookie, J2EE, cookie HTTP cookie, [cookie1] = [value1]; [Cookie2] = [2];...

:

Cookie: userLocale=en; userTimezone=Europe/Berlin; JSESSIONID=DCFE1E7FB2C6BFFDD5153B7C79B9CEED; _ga=GA1.1.1774863087.1561033937

Answer 3

It will be sent as

Cookies: JSESSIONID = CFU; customCookie = SOMEOTHERTHIG

In a hat