Is the value returned by HttpSession.getId() guaranteed to be unique across time -- or only unique among all active sessions?
In other words, can I use it as a key for a session log entry (which user logged in when and for how long)?
If getId is implementation-specific (which I’m guessing it is, as the J2EE spec is silent about this issue), how is it treated on Google App Engine?
As far as i know, the session IDs are only unique as long as you did not restart the webserver. So the Session ID is unique across time during the lifecycle of your webserver.
In Apache Tomcat you can check out ManagerBase.generateSessionId() to learn how the ID is generated. But beware in Tomcat the generated IDs are only unique across the same context.
hope that helped