I have a web app for which I’m using Java Server Faces (and PrimeFaces) for the frontend, Spring for the backend and Wildfly 15.0.1.Final as my application server.

The app was originally deployed on-premise, without using Kubernetes. When I visit the home page, for example, the URL is something like example.com/index.jsf. When I deploy it locally, it’s similar, along the lines of localhost:8080/index.html. In both cases, the page creates 4 or 5 cookies, including the “JSESSIONID” cookie that’s used to keep track of the user’s session.

Now, I’m trying to deploy the app in a Kubernetes cluster using sticky sessions, but the problem is that the JSESSIONID cookie is sent through the URL, making the URL something like example.com/index.jsf;jsessionid=2XSwgmqvaCLHf5WDrDV6LZGc6onqkMQPCHUBwiW7. When I check the storage through the dev tools in Firefox, the cookie is not set. The only cookie that’s there is “INGRESSCOOKIE”, which is the default name for the cookie that’s used for the sticky session.

I don’t want the cookie to be shown in the URL, as I think that poses a security threat, and any non-technical user that copies and pastes the URL will unknowingly be also sending their session.

Have in mind that in both cases (with and without Kubernetes) I’m using the exact same codebase, so that makes me think that there’s something in Kubernetes that’s the cause for this problem. I’m also pretty new to Kubernetes, so maybe there’s some obvious config or parameter that I don’t know about.

I’ve tried disabling the sticky session.

I’ve used NodePort (instead of using the Ingress).

I’ve tried adding this entry to my web.xml:

<session-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

None of those solutions removed the JSESSIONID from the URL.