We were able to replicate the problem with 4.0.4. It is unrelated to JBoss. One of our pages redirected to a page with a different a fully qualified domain (ie. domain.foo.bar) and the session was regenerated as it should be. We replaced the simple path (ie. domain) with the fully qualified one and the session is held and the redirect works. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3993168#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...