the JSESSION cookie path seems to be set to '/'. This will bleed sessionids between deployed WARs. I think it bleeds cached sessions too? I'll log a bug unless it is by design. -- Bill Burke JBoss, a division of Red Hat http://bill.burkecentral.com