<p>I need to prevent <a href="http://www.owasp.org/index.php/Session_Fixation" rel="noreferrer">Session Fixation</a>, a particular type of session hijacking, in a Java web application running in JBoss. However, it appears that the standard idiom <a href="http://www.owasp.org/index.php/Session_Fixation_in_Java" rel="noreferrer">doesn't work in JBoss</a>. Can this be worked around?</p>

This defect
(found
here
) points the way to the solution. The Tomcat instance that runs in JBoss is configured with emptySessionPath="true", rather than "false", which is the default. This can be modified in
```
.../deploy/jboss-web.deployer/server.xml
```
; both the HTTP and AJP connectors have this option.
The feature itself is used to eliminate the context path (eg. "foo" in
http://example.com/foo
) from being included in the JSESSIONID cookie. Setting it to false will break applications that rely on cross-application authentication, which includes stuff built using some portal frameworks. It didn't negatively affect the application in question, however.