https://bugzilla.redhat.com/show_bug.cgi?id=1311085
--- Doc Text *updated* by Timothy Walsh <twalsh(a)redhat.com> ---
It was found that Tomcat would not recycle the requestedSessionSSL field. This gave the
client the ability to control the session ID. It was also necessary for at least one web
application to be configured to use the SSL session ID as the HTTP session ID. This is not
a common configuration.
--
You are receiving this mail because:
You are on the CC list for the bug.