You can only access conversations that were initiated from your session. If you are worried about session hijacking then fine, but it has nothing to do with integer conversation IDs. "dhinojosa" wrote : Just the standard hijacking, knowing that there is a possibility of say <1000 conversationIds for a standard run of the mill shopping cart site. | View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4079822#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...