Do all browsers support HttpSessions??

Question

I have a web application that for some reason will not allow some users to use HttpSession objects and this keeps causing null pointer exceptions in my servlets.
Are there any browser settings in modern browsers that prevent the user from using HttpSessions - as this is baffling me!! I have also heard of 'encoding the session id' into the url what does this involve??
Cheers,
Stuart

Answer 1

the HttpSession data is stored on the Server Side. That data is keyed via a small key called the session ID. This session ID is needed for clients to repeatably get the same HttpSession object from the server as they navigate your pages. The session ID needs to be stored on the client in one of two ways: A Cookie, or URL rewriting.
URL rewriting involves letting the server put the sessionID on requested URLS. So, you bounce a user to myjsp.jsp, and the server adds ?sessionID=123123123123.
A Cookie means that the server creates a -1 timeout Cookie on the client's PC. That means that the session ID stays there until the browser is closed. That doesn't mean though, that the server side session wont expire as long as the browser is open.
What you are probably seeing is browsers that have Cookies turned off.
There a quick javascript checks that see if cookies are allowed.
Yoda.