Too many conversations going on at once. anonymous wrote : CptnKirk, do you have a different method for handling this? You could use some indirection here. You can have your request param id be a key to a session/conversation value. This way the actual id is never exposed. If the param is manipulated it won't be found in the session/conversation and you provide error handling from there. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3957524#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...