Broadleaf Commerce Discussion Forums

Hi,

I want to check if it is a good practice to use disable-url-rewriting (http://static.springsource.org/spring-security/site/docs/3.0.x/reference/appendix-namespace.html) like below in spring security to remove jsessionid from url?

<http auto-config="false" use-expressions="true" disable-url-rewriting="true">

Thanks,
Srini.

It depends on what you need to support for your end users. Without the url rewriting, your users must have cookies enabled in their browsers to be able to login or have a session. If this is acceptable, then not having security rewrite urls is fine.