Instead of just using the Apache mod_rewrite rules from my post on "Hiding jsessionid parameters from Google", which uses redirects, wouldn't it be better to simply not output the jsessionid parameter into the URLs?

First, what are those jsessionid params, and why are they there?

For a web application to have state, i.e. remember things from one page request to the next (such as that you're logged in, who you are, what is in your shopping cart, etc...), most web applications have something called a session. The session starts when you hit the website at first, sticks with you while you are on the site, and expires after you have either logged out or have been idle (i.e. not clicked on anything) for a set period of time (perhaps 30 minutes).

In general the actual session data is held on the server, things like your shopping cart, your user profile, all of that. However, in order to associate requests from your web browser with the correct session, your browser needs to pass something for the web application to recognize which session is yours. This is traditionally done in two ways:

firstly and primarily using a session-life browser cookie (or two) which hold a session identifier and optionally some additional security token(s). The browser receives this cookie from the web application, and then sends the cookie back to the web application with each page request. The web application looks at the cookie, and figures out which session is yours, and handles your page request appropriately.

secondly, and usually only as a fall-back for browsers which do not support cookies or whose cookie support has been turned off, is to rewrite every link in the web application which points to another page in the same web application with a special session id added to the URI of the link. This is usually done as a path parameter (following a ';'), but sometimes is also done as a query parameter (following a '?').

Since on the first request to a web application, the browser is not sending a session cookie, the web application has no way of knowing if the browser actually supports cookies or not. So for the first page, the web application will usually send back the session cookie AND rewrite all of the links on the page with the jsessionid just in case the cookie is not returned.

So what's the problem?

Search engine spiders, like Google's GoogleBot, usually do not support cookies. This means that they see the site with the jsessionid parameter in every link and every requested URL. So this leads to three related problems. First, the links that show up in a Google search include an ugly 'jsessionid=xxxxxx' which looks ugly. Second, Google doesn't recognize that the jsessionid parameter doesn't change the page content, and as such each time the GoogleBot hits the site, and gets a different jsessionid, it indexes all of the pages again. This leads to getting multiple result listings for the same page in search results. For instance you might see the same page listed 7 times in a row. Third, by having multiple instances of the same page with the same content, the Google PageRank of the actual page is severely diluted and perhaps even penalized due to the multiple presentations.

Because of these problems, we do not want the GoogleBot to see the jsessionid URI parameters.

In my earlier post, linked to above, I used Apache mod_rewrite to look for requests from GoogleBot, and send a redirect back to GoogleBot, redirecting it to the same URI it had initially requested, just stripped of the jsessionid parameter.

This time I'm going to use a Servlet Filter to prevent the jsessionid parameter from being inserted into the URL links on the page for GoogleBot requests. This is more elegant since there are no redirects.

First, I want to link to the web page which provided the starting point for the solution I used: JSESSIONID considered harmful

I took that approach and modified the filter code to only do this for GoogleBot requests, which will allow users who don't support or allow cookies to still use the site.

I have one Java class: DisableUrlSessionFilter.java

 
package com.howgoodiwas.util;
 
import java.io.IOException;
 
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletResponseWrapper;
 
/**
 * Servlet filter which disables URL-encoded session identifiers.
 *
 *
 * Copyright (c) 2006, Craig Condit. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are met:
 *
 * * Redistributions of source code must retain the above copyright notice,
 * this list of conditions and the following disclaimer.
 * * Redistributions in binary form must reproduce the above copyright notice,
 * this list of conditions and the following disclaimer in the documentation
 * and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 * Modified by Devon Hillard (devon@digitalsanctuary.com) to only filter for GoogleBot,
 * not for users without cookies enabled.
 *
 */
@SuppressWarnings("deprecation")
public class DisableUrlSessionFilter implements Filter {
 
    /**
     * The string to look for in the User-Agent header to identify the GoogleBot.
     */
    private static final String GOOGLEBOT_AGENT_STRING = "googlebot";
 
    /**
     * The request header with the User-Agent information in it.
     */
    private static final String USER_AGENT_HEADER_NAME = "User-Agent";
 
    /**
     * Filters requests to disable URL-based session identifiers.
     *
     * @param pRequest
     *                the request
     * @param pResponse
     *                the response
     * @param pChain
     *                the chain
     *
     * @throws IOException
     *                 Signals that an I/O exception has occurred.
     * @throws ServletException
     *                 the servlet exception
     */
    public void doFilter(final ServletRequest pRequest, final ServletResponse pResponse, final FilterChain pChain)
	    throws IOException, ServletException {
	// skip non-http requests
	if (!(pRequest instanceof HttpServletRequest)) {
	    pChain.doFilter(pRequest, pResponse);
	    return;
	}
 
	HttpServletRequest httpRequest = (HttpServletRequest) pRequest;
	HttpServletResponse httpResponse = (HttpServletResponse) pResponse;
 
	boolean isGoogleBot = false;
 
	if (httpRequest != null) {
	    String userAgent = httpRequest.getHeader(USER_AGENT_HEADER_NAME);
	    if (StringUtils.isNotBlank(userAgent)) {
		if (userAgent.toLowerCase().indexOf(GOOGLEBOT_AGENT_STRING) > -1) {
		    isGoogleBot = true;
		}
	    }
	}
 
	if (isGoogleBot) {
	    // wrap response to remove URL encoding
	    HttpServletResponseWrapper wrappedResponse = new HttpServletResponseWrapper(httpResponse) {
		@Override
		public String encodeRedirectUrl(final String url) {
		    return url;
		}
 
		@Override
		public String encodeRedirectURL(final String url) {
		    return url;
		}
 
		@Override
		public String encodeUrl(final String url) {
		    return url;
		}
 
		@Override
		public String encodeURL(final String url) {
		    return url;
		}
	    };
 
	    // process next request in chain
	    pChain.doFilter(pRequest, wrappedResponse);
	} else {
	    pChain.doFilter(pRequest, pResponse);
	}
    }
 
    /**
     * Unused.
     *
     * @param pConfig
     *                the config
     *
     * @throws ServletException
     *                 the servlet exception
     */
    public void init(final FilterConfig pConfig) throws ServletException {
    }
 
    /**
     * Unused.
     */
    public void destroy() {
    }
}
 

and the servlet filter configuration in my web.xml file:

 
	<filter>
		<filter-name>DisableUrlSessionFilter</filter-name>
		<filter-class>
			com.howgoodiwas.util.DisableUrlSessionFilter
		</filter-class>
	</filter>
 
....
 
	<filter-mapping>
		<filter-name>DisableUrlSessionFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
 

So far, it seems to be working beautifully. It only impacts the GoogleBot, and it successfully strips the jsessionid parameter from the links on the site.

Enjoy!

Optimizing sites for Google rankings isn't a focus of mine, but is an inevitable factor that must be addressed when building any site. I'm no SEO expert, then again, neither are half of those who claim to be.

The best thing you can do is to have your site be real, be useful, be focused on a specific topic or niche, and make sure links to it show up on other relevant sites.

A simple way to get those links is to make your site's URL part of your signature, and post HELPFUL posts on relevant forums, blogs, etc... Be engaged in other communities who serve a demographic similar to your site's ideal demographic. Become a contributing and trusted member. Your posts will drive the best type of traffic to your site.

As someone who uses Google to find content 1,000 times more than I use Google to get traffic to my site, I am firmly against gaming the system, link farming, spam, google bombs, or anything that drives down the signal-to-noise of search results. But there are steps you should take to ensure your site shows up as good signal where it should.

1. Provide free information. Even if you're an e-commerce site, provide free product information, reviews, specifications, research, forums, etc... People tend to research online before they buy. If they do their research at your site, they're more likely to buy from you because by providing helpful, ideally unbiased, information free of charge, your site will be more trusted. You will also end up with more external sites linking to your helpful free information, than would have linked to your Buy Me Now page. Useful information is valuable, and is referenced far more often than a commerce only page.

2. Ensure the information is visible to the Search Engines. Content in images, Flash, Ajax loaded data, sometimes iframes, etc... is not visible to search engines. If you must present information that way, ensure the same information is available via plain html. You can use javascript to load Flash over html for instance. Test your site using a text-based web browsers such as lynx or links. Make sure your site is structured well, has all your content available, and "works".

3. The Title tag: should be the first tag within the head tag. Should be about 9 words. Keywords should be toward the beginning. Do not repeat words. It should be readable to a person and make sense. It should be unique for each page.

4. The Description tag: should be the second tag within the head tag. Should be about 16-20 words. It should be made up of complete sentences, with keywords toward the beginning. It should be readable to a person and make sense. It should be unique for each page.

5. The Keywords tag: should be the third tag within the head tag. Should be 30-50 words (assuming they're all relevant). Should be in short phrase form, separated by commas. Capitalize all words. It should be unique for each page.

6. Heading content ( tags): should contain keyword phrases, but should not repeat identical phrases. Should be 2-4 words. Should structure your document just like an outline for a paper or presentation.

7. Image alt tags: every image should have an alt tag. The alt tag should be no more than 12 words long. It must be descriptive to a person and describe the image or it's purpose in the page clearly. Again, test with a text-based web browser to see the alt tags in context.

8. Links: use keywords in the URL (more on this later). The link text should contain keywords. The surrounding text should also be keyword rich, using keywords which are relevant for the target page.

9. Main Content: Minimum of 300 words. Make the first 150-200 words keyword rich. Think of it like an executive summary. Words used in your title, description, and keyword head tags should appear at least twice each within the main text. CSS and JS should be externalized so as to not obscure the focus on the text.

10. URLs should be made up of useful words, separated by hyphens. Bad: "blog2" Good: "tech-blog". Bad: "/prod.jsp?id=1342342" Good: "/mp3-players/apple/ipod/ipod-nano.jsp". Many blogging tools and e-commerce tools will create category based faux directory structures for your pages.

Try to keep these guidelines in mind while building your site and templates. In general most of these tips not only help search engines understand your site best, but also help with accessibility, graceful degradation of browsers, and general readability for your users.

I'd welcome any other tips in the comments. Or any ideas around specific products (ATG, Seam, etc...).