Under what conditions is a JSESSIONID created?

JSESSIONID cookie is created/sent when session is created. Session is created when your 
code calls request.getSession() or request.getSession(true) for the first time. 
If you just want get session, but not create it if it doesn't exists, 
use request.getSession(false) -- this will return you a session or null. In this case, new session is not created, and JSESSIONID cookie is not sent. (This also means 
that session isn't necessarily created on first request... you and your code is in control when the session is created)


HttpSession objects must be scoped at the application (or servlet context) level. The 
underlying mechanism, such as the cookie used to establish the session, can be the same 

for different contexts, but the object referenced, including the attributes in that object, 
must never be shared between contexts by the container.