When running a java web application with the servlet api (like JSF or JSP pages), somewhere along the line a 'unique' SessionID is generated to identify the user's session.
I'm wondering how these sessionID's are generated. Do they include the IP of the client? A timestamp? Random numbers?
Secondly, I'm wondering where this generation happens? Is this dependent on the server that runs the application?
It is container specific. Tomcat: http://tomcat.apache.org/tomcat-7.0-doc/security-howto.html#Manager