JSTL has a feature to rewrite URLs correctly if no cookies are enabledat the client.
URLs can be rewritten to track sessions.
SSL has a mechanism that can be used by a container for session tracking.
Sessions may be tracked using cookies.