> The path parameter is appended to every outgoing redirect by the servlet > container Really? I assumed it would only touch redirects to itself, at most. That's...broken. The leakage of the session ID alone makes that a security bug, seems to me. -- Scott