This bug was initially raised against Spring Boot (see https://github.com/spring-projects/spring-boot/issues/2065 for background).

I assume that the DeploymentInfo class should have an empty string when it represents the root context (mirroring the standard ServletContext.getContextPath rules). When this is the case the cookie created for the session doesn't include a path attribute.

I think the problem is that the ServletContextImpl constructor calls sessionCookieConfig.setPath(deploymentInfo.getContextPath());. It should probably only do this if the context path is not empty.