title: How does Tomcat maintain session integrity?
body: <p><code>HttpServletRequest</code>'s <a href="http://download.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getSession%28boolean%29" rel="nofollow">getSession(boolean)</a> method mentions session integrity. How does Tomcat maintains session integrity? What rules does it use? What method? What is happening under the hood precisely?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>How and when is a specific session ID is created? Does Tomcat rely on IP address and port for example?</p>