Fine grained control of sessions

Question

Hello,
at the moment I'm developing a web application for my company using JSP for the presentation tier. The main pupose of the site is to inform customers about our products, but it should contain some kind of shopping cart, too.
My problem is:
Because of of various reasons I don't want a session object (and a session id) to be created as long as the client just visits pages with static content. But as soon as he orders something, a session should be triggered and should persist as long as necessary. I would like to control this behaviour with a parameter or so.
I found a solution, but it is not very smart:
On every JSP I add the following code at the beginning:
<c:if test="${param['nosession']==1}" >
   <!-- Delete session! -->
   <% session.invalidate(); %>
</c:if>This prevents the URL-encoding of the page links. The problem is, that every time a page is requested, a new session will be created (and send as a HTTP parameter to the customer) only to be invalidated during processing of the JSP later. Are there better solutions?
Thanx in advance.
Dieter

Answer 1

you do not invalidate the session, but the session object is
unavailable only on that page.That is my understanding of how this works.
In effect it removes the implicit call to request.getSession(true) that every jsp makes to populate the variable "session"
If I use the <c:url> tag on page 2 using a cookieless browser the link
is still encoded with the session? Sorry, don't know that one.
The <url> tag will still call response.encodeURL() of course.
I'm not sure if it would pick up the presence of the sessionid or not though.
The session is definitely still there.
The cookie (if present) is obviously still there.
The sessionId is sent as part of the request.
Theoretically it SHOULD pick it up and encode it still if present. I've never tried it myself though.
Good luck,
evnafets