If your application uses session objects, you must ensure that session tracking is enabled by having the application rewrite URLs whenever the client turns off cookies. You do this by calling the response’s encodeURL(URL) method on all URLs returned by a servlet. This method includes the session ID in the URL only if cookies are disabled; otherwise, it returns the URL unchanged.

The doGet method of ShowCartServlet encodes the three URLs at the bottom of the shopping cart display page as follows:

1 out.println("
   
" + messages.getString("ContinueShopping") +  5         "      " +  6         "" + messages.getString("Checkout") + 10         "      " + 11         "" + messages.getString("ClearCart") + 15         "");

 

If cookies are turned off, the session is encoded in the Check Out URL as follows:

http://localhost:8080/bookstore1/cashier;jsessionid=c0o7fszeb1

If cookies are turned on, the URL is simply

在客户端禁止cookie的情况下，将session信息追加到url后，保持session同步。