From 302d9a6e69c4f355edc4102b58788d5d4026eb3a Mon Sep 17 00:00:00 2001
From: labkey-jeckels <jeckels@labkey.com>
Date: Mon, 18 May 2026 13:27:52 -0700
Subject: [PATCH] Prohibit HTTP GET parameters for jsessionid

---
 api/webapp/WEB-INF/web.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/api/webapp/WEB-INF/web.xml b/api/webapp/WEB-INF/web.xml
index 3dbc079f803..450a46349cd 100755
--- a/api/webapp/WEB-INF/web.xml
+++ b/api/webapp/WEB-INF/web.xml
@@ -58,6 +58,11 @@
         <url-pattern>*.post</url-pattern>
     </filter-mapping>
 
+    <!-- Ensure that we never use GET parameters for session IDs -->
+    <session-config>
+        <tracking-mode>COOKIE</tracking-mode>
+    </session-config>
+
     <welcome-file-list>
         <welcome-file>/</welcome-file>
     </welcome-file-list>