From "Question of new SessionIdGenerator implementation." thread on dev@, http://tomcat.markmail.org/thread/2lic23zbhesgftld If reloading Manager( or Context), SessionIdGenerator is cleared in ManagerBase.stopInternal() and re-created in ManagerBase.startInternal(). Expected: If there is <SessionIdGenerator> element in a <Manager> element, restarting a web application should preserve the options set on it. Actual: Any configuration options specified on <SessionIdGenerator> configuration element are lost. Workaround ----------- A workaround is to specify attributes such as "sessionIdLength" on Manager element. Fix ---- The fix is probably to let SessionIdGenerator to implement Lifecycle interface. The "this.sessionIdGenerator = null;" assignment in ManagerBase.stopInternal() originates from r1044874. The old code before r1044874 was calling "randoms.clear();" there. I think it is easier to expose that clear method via Lifecycle.stop(). Technically, there was no bug in r1044874 itself, as that was just an internal implementation change. It have not exposed SessionIdGenerator as a configuration element. The ability configure session id generator via an XML element was added later in r1619056.
This has been fixed in 8.0.x and will be included in 8.0.15 onwards.