Which of the following statements are not true?
-
URL rewriting may be used by a server as the basis for session tracking.
-
SSL has a built-in mechanism that a servlet container could use to obtain data used to define a session.
-
When using cookies for session tracking, the name of the session tacking cookie must be JSESSIONID.
-
IF a user has cookies disabled in the browser, the container may choose to use a javax.servlet.httpCookielessHttpSession object to track the user's session.
Option D is FALSE (making it the correct answer to 'which is NOT true') because there is no such class as javax.servlet.http.CookielessHttpSession in the Servlet API. When cookies are disabled, containers use URL rewriting (appending the session ID to URLs) - they don't switch to a different HttpSession implementation class. Options A, B, and C are all TRUE statements: URL rewriting is a valid session tracking mechanism; SSL sessions can be used; and JSESSIONID is the standard cookie name (though containers can configure a different name).