URL rewriting may be used by a server as the basis for session tracking.

SSL has a built-in mechanism that a servlet container could use to obtain data used to define a session.

When using cookies for session tracking, the name of the session tacking cookie must be JSESSIONID.

IF a user has cookies disabled in the browser, the container may choose to use a javax.servlet.httpCookielessHttpSession object to track the user's session.