要点：只要用户不登录或不执行POST操作，就不要让您的应用创建会话。请勿致电
request.getSession()或
request.getSession(true)。不要为未登录的用户创建或管理会话范围的Bean。确保您正在使用的框架不会不必要地创建会话，除非您先声明要这样做。
如果由于应用程序的设计方式或所用（MVC）框架的局限性/错误而 确实
无法做到这一点，那么最好的选择是将Googlebot请求重定向到没有JSESSIONID标识符的URL。您可以为此使用Tuckey的URL重写过滤器（即Apache
HTTPD的Java变体
mod_rewrite）。以下是其配置示例页面中的相关摘录。
隐藏来自Googlebot的请求的jsessionid。
<outbound-rule> <name>Strip URL Session ID's</name> <note> Strip ;jsession=XXX from urls passed throughresponse.enpreURL().
The characters ? and # are the only things we can use to find
out where the jsessionid ends.
The expression in ‘from’ below contains three capture groups,
the last two being optional.
1, everything before ;jesessionid
2, everything after ;jesessionid=XXX starting with a ? (to
get the query string) up to #
3, everything ;jesessionid=XXX and optionally ?XXX starting
with a # (to get the target)
eg,
from index.jsp;jsessionid=sss?qqq to index.jsp?qqq
from index.jsp;jsessionid=sss?qqq#ttt to index.jsp?qqq#ttt
from index.jsp;jsessionid=asdasdasdsadsadasd#dfds -
index.jsp#dfds
from u.jsp;jsessionid=wert.hg - u.jsp
from /;jsessionid=tyu - /
