Selecting a Session Tracking Mechanism
As noted, in the first response after a session is created, the servlet both sends a cookie and rewrites URLs
If the browser returns the session ID cookie in a subsequent request, URL-rewriting can be disabled.
If the browser is not returning cookies, URL-rewriting will continue.
All this happens “behind the scenes”: the servlet programmer may not even be aware of the mechanism.