Created attachment 23920 [details] Example war consisting of the above web.xml and JSP files Page session directive appears to be ignored when specified in include-prelude declarations. For example, the following configuration should ensure that JSP pages do not create sessions. This works in 6.0.14, but not in 6.0.20 (I've not test 6.0.18 yet). /WEB-INF/web.xml: <?xml version="1.0"?> <web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" version="2.4"> <jsp-config> <jsp-property-group> <url-pattern>*.jsp</url-pattern> <include-prelude>/WEB-INF/prelude.jsp</include-prelude> </jsp-property-group> </jsp-config> </web-app> /WEB-INF/prelude.jsp: <%@ page session="false" %> /index.jsp: <!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <title>Session Test</title> </head> <body> <% if (null != request.getSession(false)) { %>Session present<% } else { %>Session not present<% }%> </body> </html> I've attached a sample WAR file containing the above files. Under 6.0.20, the output will be 'Session present', whereas in 6.0.14 the output will be 'Session not present'. Has the behaviour of preludes been intentionally changed in 6.0.20? I've not seen any specific in the change logs between versions.
*** This bug has been marked as a duplicate of bug 47318 ***