How can I retain the session when using window.open() to open a new window?

It depends on where you are opening your new window from?

• If it is a JSP then just use the encodeURL method to generate the new window URL. Something like the following for your url:

  <%=response.encodeURL(...)%>
  

  all that does is put the session id on the end of the url as an additional name/value pair in the query.
• If it is an HTML page then how is it generated? If it just a static file then I dont think you can get the session info to it, you'll have to change the page to be generated by a JSP or servlet. If it is already generated by a servlet you can jst use the encodeURL method to create the URL and place it in the generated page.