title: what is the vulnerability of having Jsessionid on first request only
body: <p>Recently we removed jsessionid from URL did cookies based session management  to prevent "session hijacking attack"</p>
  
  <p>But we found that first request URL always has jsessionid when cookies are enabled and subsequent request URL has NO jsessionid.</p>
  
  <p>using the jsessionid from first url we could directly hit other pages in the workflow</p>
  
  <p><strong>Question : is there any security vulnerability exposing jsessionid only on first request?</strong></p>
  
  <p>There is a solution to remove jsessionid from first request , but wanted to check , if its really vulnerable to mandate the changes</p>
  
  <p>thanks
  J </p>
  
  <p>EDIT : I got my doubt clarified. Thanks for replies.</p>