...it's all fine and dandy that the Jakarta folks are improving Tomcat but I still can't understand why on earth they won't fix the damn hardcoded session cookie name.
I once asked about it on the devel list and the answer(s) was along the lines of "the spec says the cookie is named 'JSESSIONID' and we won't diverge from the spec in this case". Ok. Except that not letting users configure the damn session cookie name effectively prevents those same users from deploying their applications on Tomcat in certain shared environments.
I can live without having used Tomcat in that one project. I just don't understand why the Tomcat developers have been so reluctant of implementing relatively simple functionality that would clearly provide benefits for "enterprise" users who are simply not allowed to deploy anything behind a certain SiteMinder protected cluster with the standard session cookie name. It's not like 5 years is too short a time for such a drastic architectural change, is it?
I'm not sure if you're being sarcastic or not, but the problem really is that even if I'd create a patch, the committers wouldn't accept the patch. I got a pretty clear answer saying so from more than one committer.
Oh, and just hardcoding the session cookie naming to something else and recompiling was not an option with the organization I was consulting for. Forking a codebase is not always an option.