Unsafe value for session tracking in WEB-INF/web.xml
Description
This web application is configured to support session tracking by cookies and URLs. The session tracking by URL is also known as "URL rewriting" wherein you see the ;jsessionid=id to appear in URLs. This will be triggered automatically when the client has cookies disabled. It's recommended to disable tracking by URL, and explicitly specify a tracking mode by cookie only.
Remediation
Change the value for <strong>tracking-mode</strong> in WEB-INF/web.xml to make sure the JSESSIONID is stored in a cookie: <pre> <session-config> <tracking-mode>COOKIE</tracking-mode> </session-config> </pre>