jsp页面中 form表单的action属性 我需要拼接session的id 怎么做? 不能使用js

如果你需要在 JSP 页面中拼接 session ID，可以使用 JSP EL 表达式来获取 session ID。EL 表达式使用 `${}` 语法，在其中调用 `session` 对象的 `getId()` 方法获取 session ID，如下所示：

<form action="someAction.jsp;jsessionid=${session.id}">
  <!-- 表单元素 -->
</form>

其中，`${session.id}` 表达式会被解析为当前 session 对象的 ID，然后拼接到表单的 action 属性后面。注意，在表单的 action 属性中指定 session ID 时，需要在 JSP 页面中关闭 URL 重写功能，否则服务器会忽略表单中指定的 session ID，生成新的 session ID。

关闭 URL 重写功能的方法是在 `web.xml` 文件中配置 `disable-url-rewriting` 参数，如下所示：

<session-config>
  <tracking-mode>COOKIE</tracking-mode>
  <cookie-config>
    <http-only>true</http-only>
    <secure>true</secure>
  </cookie-config>
  <tracking-mode>URL</tracking-mode>
  <tracking-mode>SSL</tracking-mode>
  <tracking-mode>NONSSL</tracking-mode>
  <tracking-mode>COOKIE</tracking-mode>
  <tracking-mode>SSL+URL</tracking-mode>
  <tracking-mode>NONSSL+URL</tracking-mode>
  <tracking-mode>URL+COOKIE</tracking-mode>
  <tracking-mode>SSL+COOKIE</tracking-mode>
  <tracking-mode>NONSSL+COOKIE</tracking-mode>
  <tracking-mode>DISABLE</tracking-mode>
</session-config>
<context-param>
  <param-name>org.apache.catalina.STRICT_SERVLET_COMPLIANCE</param-name>
  <param-value>true</param-value>
</context-param>
<context-param>
  <param-name>org.apache.tomcat.util.http.ServerCookie.ALLOW_EQUALS_IN_VALUE</param-name>
  <param-value>true</param-value>
</context-param>
<context-param>
  <param-name>org.apache.tomcat.util.http.ServerCookie.ALLOW_HTTP_SEPARATORS_IN_V0</param-name>
  <param-value>true</param-value>
</context-param>
<context-param>
  <param-name>org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR</param-name>
  <param-value>true</param-value>
</context-param>
<context-param>
  <param-name>org.apache.tomcat.util.http.ServerCookie.ALWAYS_ADD_EXPIRES</param-name>
  <param-value>false</param-value>
</context-param>
<context-param>
  <param-name>org.apache.tomcat.util.http.ServerCookie.REJECT_PUBLIC_SUFFIXES</param-name>
  <param-value>true</param-value>
</context-param>
<filter>
  <filter-name>httpHeaderSecurity</filter-name>
  <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
  <async-supported>true</async-supported>
  <init-param>
    <param-name>hstsEnabled</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>hstsMaxAgeSeconds</param-name>
    <param-value>31536000</param-value>
  </init-param>
  <init-param>
    <param-name>hstsIncludeSubDomains</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>xContentTypeOptionsEnabled</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>xFrameOptionsEnabled</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>xssProtectionEnabled</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>contentTypeNosniff</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>blockContentTypeSniffingEnabled</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>referrerPolicy</param-name>
    <param-value>strict-origin-when-cross-origin</param-value>
  </init-param>
  <init-param>
    <param-name>featurePolicy</param-name>
    <param-value>geolocation 'self'; midi 'self'; sync-xhr 'self'; microphone 'self'; camera 'self'; magnetometer 'self'; gyroscope 'self'; speaker 'self'; fullscreen 'self'; payment 'self';</param-value>
  </init-param>
</filter>
<filter-mapping>
  <filter-name>httpHeaderSecurity</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

其中，`<tracking-mode>DISABLE</tracking-mode>` 参数指定了关闭 URL 重写功能。