I did the tracking-mode thing in web.xml, too, and I see the same behavior. Yet, neither do I have an explanation for it.
glassfish 4.0 javax.servlet-api, 3.1.0 Mojarra 2.2.5 shiro 1.2.2 Grizzly Framework 2.3.1 WELD 2.0.0 (SP1) -- View this message in context: http://shiro-user.582556.n2.nabble.com/Why-is-JSESSIONID-on-any-URL-tp7579643p7579648.html Sent from the Shiro User mailing list archive at Nabble.com.
