diff --git a/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java b/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java
index 74f5da5..6b71250 100644
--- a/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java
+++ b/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletRequest.java
@@ -51,6 +51,7 @@
     public static final String REFERENCED_SESSION_IS_NEW = ShiroHttpServletRequest.class.getName() + "_REFERENCED_SESSION_IS_NEW";
     public static final String REFERENCED_SESSION_ID_SOURCE = ShiroHttpServletRequest.class.getName() + "REFERENCED_SESSION_ID_SOURCE";
     public static final String IDENTITY_REMOVED_KEY = ShiroHttpServletRequest.class.getName() + "_IDENTITY_REMOVED_KEY";
+    public static final String SESSION_ID_URL_REWRITING_ENABLED = ShiroHttpServletRequest.class.getName() + "_SESSION_ID_URL_REWRITING_ENABLED";
 
     protected ServletContext servletContext = null;
 
diff --git a/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletResponse.java b/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletResponse.java
index 438b3e6..744a736 100644
--- a/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletResponse.java
+++ b/web/src/main/java/org/apache/shiro/web/servlet/ShiroHttpServletResponse.java
@@ -136,6 +136,10 @@
      */
     protected boolean isEncodeable(final String location) {
 
+        // First check if URL rewriting is disabled globally
+        if (Boolean.FALSE.equals(request.getAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED)))
+            return (false);
+
         if (location == null)
             return (false);
 
diff --git a/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java b/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java
index f8baf11..eb7eda1 100644
--- a/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java
+++ b/web/src/main/java/org/apache/shiro/web/session/mgt/DefaultWebSessionManager.java
@@ -51,12 +51,14 @@
 
     private Cookie sessionIdCookie;
     private boolean sessionIdCookieEnabled;
+    private boolean sessionIdUrlRewritingEnabled;
 
     public DefaultWebSessionManager() {
         Cookie cookie = new SimpleCookie(ShiroHttpSession.DEFAULT_SESSION_ID_NAME);
         cookie.setHttpOnly(true); //more secure, protects against XSS attacks
         this.sessionIdCookie = cookie;
         this.sessionIdCookieEnabled = true;
+        this.sessionIdUrlRewritingEnabled = true;
     }
 
     public Cookie getSessionIdCookie() {
@@ -77,6 +79,15 @@
         this.sessionIdCookieEnabled = sessionIdCookieEnabled;
     }
 
+    public boolean isSessionIdUrlRewritingEnabled() {
+        return sessionIdUrlRewritingEnabled;
+    }
+
+    @SuppressWarnings({"UnusedDeclaration"})
+    public void setSessionIdUrlRewritingEnabled(boolean sessionIdUrlRewritingEnabled) {
+        this.sessionIdUrlRewritingEnabled = sessionIdUrlRewritingEnabled;
+    }
+
     private void storeSessionId(Serializable currentId, HttpServletRequest request, HttpServletResponse response) {
         if (currentId == null) {
             String msg = "sessionId cannot be null when persisting for subsequent requests.";
@@ -139,6 +150,10 @@
             //onUnknownSession method below will be invoked and we'll remove the attribute at that time.
             request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
         }
+
+        // always set rewrite flag - SHIRO-361
+        request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, isSessionIdUrlRewritingEnabled());
+
         return id;
     }
 
diff --git a/web/src/test/groovy/org/apache/shiro/web/servlet/ShiroHttpServletResponseTest.groovy b/web/src/test/groovy/org/apache/shiro/web/servlet/ShiroHttpServletResponseTest.groovy
new file mode 100644
index 0000000..a26dca7
--- /dev/null
+++ b/web/src/test/groovy/org/apache/shiro/web/servlet/ShiroHttpServletResponseTest.groovy
@@ -0,0 +1,166 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.shiro.web.servlet
+
+import org.junit.Test
+
+import javax.servlet.ServletContext
+import javax.servlet.http.HttpServletResponse
+import javax.servlet.http.HttpSession
+
+import static org.easymock.EasyMock.*
+import static org.junit.Assert.*
+
+/**
+ * Unit tests for {@link ShiroHttpServletResponse}.
+ */
+class ShiroHttpServletResponseTest {
+
+    private static String URL_SESSION_ID = "url_session_id"
+
+    @Test
+    void testEncodeURLNoSessionId() {
+
+        def servletContext = createStrictMock(ServletContext)
+        def httpServletResponse = createStrictMock(HttpServletResponse)
+        def shiroHttpServletRequest = setupRequestMock()
+        expect(shiroHttpServletRequest.getSession(false)).andReturn(null)
+        expect(shiroHttpServletRequest.getAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED)).andReturn(true)
+        replay shiroHttpServletRequest, servletContext, httpServletResponse
+
+        def shiroHttpServletResponse = new ShiroHttpServletResponse(httpServletResponse, servletContext, shiroHttpServletRequest)
+
+        assertEquals "/foobar", shiroHttpServletResponse.encodeURL("/foobar")
+        verify shiroHttpServletRequest, servletContext, httpServletResponse
+    }
+
+    @Test
+    void testEncodeURLSessionIdInURL() {
+
+        def servletContext = createStrictMock(ServletContext)
+        def httpServletResponse = createStrictMock(HttpServletResponse)
+        def session = createMock(HttpSession)
+        def shiroHttpServletRequest = setupRequestMock()
+        expect(session.getId()).andReturn(URL_SESSION_ID).anyTimes()
+        expect(shiroHttpServletRequest.getSession(false)).andReturn(session)
+        expect(shiroHttpServletRequest.getSession()).andReturn(session)
+        expect(shiroHttpServletRequest.isRequestedSessionIdFromCookie()).andReturn(false)
+        expect(shiroHttpServletRequest.getAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED)).andReturn(true)
+        replay shiroHttpServletRequest, servletContext, httpServletResponse, session
+
+        def shiroHttpServletResponse = new ShiroHttpServletResponse(httpServletResponse, servletContext, shiroHttpServletRequest)
+
+        assertEquals "/foobar;JSESSIONID=" + URL_SESSION_ID, shiroHttpServletResponse.encodeURL("/foobar")
+        verify shiroHttpServletRequest, servletContext, httpServletResponse, session
+    }
+
+    @Test
+    void testEncodeURLSessionIdInCookie() {
+
+        def servletContext = createStrictMock(ServletContext)
+        def httpServletResponse = createStrictMock(HttpServletResponse)
+        def session = createMock(HttpSession)
+        def shiroHttpServletRequest = setupRequestMock()
+        expect(shiroHttpServletRequest.getAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED)).andReturn(false)
+        replay shiroHttpServletRequest, servletContext, httpServletResponse, session
+
+        def shiroHttpServletResponse = new ShiroHttpServletResponse(httpServletResponse, servletContext, shiroHttpServletRequest)
+
+        assertEquals "/foobar", shiroHttpServletResponse.encodeURL("/foobar")
+        verify shiroHttpServletRequest, servletContext, httpServletResponse, session
+    }
+
+    @Test
+    void testEncodeURLSessionIdInWhenRewriteDisabled() {
+
+        def servletContext = createStrictMock(ServletContext)
+        def httpServletResponse = createStrictMock(HttpServletResponse)
+        def session = createMock(HttpSession)
+        def shiroHttpServletRequest = setupRequestMock()
+        expect(shiroHttpServletRequest.getAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED)).andReturn(false)
+        replay shiroHttpServletRequest, servletContext, httpServletResponse, session
+
+        def shiroHttpServletResponse = new ShiroHttpServletResponse(httpServletResponse, servletContext, shiroHttpServletRequest)
+
+        assertEquals "/foobar", shiroHttpServletResponse.encodeURL("/foobar")
+        verify shiroHttpServletRequest, servletContext, httpServletResponse, session
+    }
+
+    /**
+     * Tests if the request attribute {@link ShiroHttpServletRequest}.SESSION_ID_URL_REWRITING_ENABLED is not false
+     * boolean, the default behavior is to encode the URL.
+     */
+    @Test
+    void testEncodeURLSessionIdInWhenRewriteInvalid() {
+
+        def servletContext = createStrictMock(ServletContext)
+        def httpServletResponse = createStrictMock(HttpServletResponse)
+        def session = createMock(HttpSession)
+        def shiroHttpServletRequest = setupRequestMock()
+        expect(session.getId()).andReturn(URL_SESSION_ID).anyTimes()
+        expect(shiroHttpServletRequest.getSession(false)).andReturn(session)
+        expect(shiroHttpServletRequest.getSession()).andReturn(session)
+        expect(shiroHttpServletRequest.isRequestedSessionIdFromCookie()).andReturn(false)
+        expect(shiroHttpServletRequest.getAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED)).andReturn("something-else")
+        replay shiroHttpServletRequest, servletContext, httpServletResponse, session
+
+        def shiroHttpServletResponse = new ShiroHttpServletResponse(httpServletResponse, servletContext, shiroHttpServletRequest)
+
+        assertEquals "/foobar;JSESSIONID=" + URL_SESSION_ID, shiroHttpServletResponse.encodeURL("/foobar")
+        verify shiroHttpServletRequest, servletContext, httpServletResponse, session
+    }
+
+    /**
+     * Tests if the request attribute {@link ShiroHttpServletRequest}.SESSION_ID_URL_REWRITING_ENABLED is null,
+     * the default behavior is NOT to encode the URL.
+     */
+    @Test
+    void testEncodeURLSessionIdInWhenRewriteInvalidAndNull() {
+
+        def servletContext = createStrictMock(ServletContext)
+        def httpServletResponse = createStrictMock(HttpServletResponse)
+        def session = createMock(HttpSession)
+        def shiroHttpServletRequest = setupRequestMock()
+        expect(session.getId()).andReturn(URL_SESSION_ID).anyTimes()
+        expect(shiroHttpServletRequest.getSession(false)).andReturn(session)
+        expect(shiroHttpServletRequest.getSession()).andReturn(session)
+        expect(shiroHttpServletRequest.isRequestedSessionIdFromCookie()).andReturn(false)
+        expect(shiroHttpServletRequest.getAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED)).andReturn(null)
+        replay shiroHttpServletRequest, servletContext, httpServletResponse, session
+
+        def shiroHttpServletResponse = new ShiroHttpServletResponse(httpServletResponse, servletContext, shiroHttpServletRequest)
+
+        assertEquals "/foobar;JSESSIONID=" + URL_SESSION_ID, shiroHttpServletResponse.encodeURL("/foobar")
+        verify shiroHttpServletRequest, servletContext, httpServletResponse, session
+    }
+
+
+    private static ShiroHttpServletRequest setupRequestMock() {
+        def shiroHttpServletRequest = createMock(ShiroHttpServletRequest)
+
+        expect(shiroHttpServletRequest.getScheme()).andReturn("http").anyTimes()
+        expect(shiroHttpServletRequest.getServerName()).andReturn("localhost").anyTimes()
+        expect(shiroHttpServletRequest.getServerPort()).andReturn(8080).anyTimes()
+        expect(shiroHttpServletRequest.getContextPath()).andReturn("/").anyTimes()
+
+
+        return shiroHttpServletRequest
+    }
+
+}
diff --git a/web/src/test/groovy/org/apache/shiro/web/session/mgt/DefaultWebSessionManagerTest.groovy b/web/src/test/groovy/org/apache/shiro/web/session/mgt/DefaultWebSessionManagerTest.groovy
index f06762b..526636c 100644
--- a/web/src/test/groovy/org/apache/shiro/web/session/mgt/DefaultWebSessionManagerTest.groovy
+++ b/web/src/test/groovy/org/apache/shiro/web/session/mgt/DefaultWebSessionManagerTest.groovy
@@ -126,6 +126,7 @@
                 ShiroHttpServletRequest.COOKIE_SESSION_ID_SOURCE);
         request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
         request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
+        request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, Boolean.TRUE);
 
         replay(cookie);
         replay(request);
@@ -160,6 +161,7 @@
                 ShiroHttpServletRequest.URL_SESSION_ID_SOURCE);
         request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
         request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
+        request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, Boolean.TRUE);
 
         replay(cookie);
         replay(request);
@@ -195,6 +197,7 @@
                 ShiroHttpServletRequest.URL_SESSION_ID_SOURCE);
         request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
         request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
+        request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, Boolean.TRUE);
 
         replay(cookie);
         replay(request);
@@ -225,6 +228,7 @@
         request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, ShiroHttpServletRequest.URL_SESSION_ID_SOURCE);
         request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
         request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
+        request.setAttribute(ShiroHttpServletRequest.SESSION_ID_URL_REWRITING_ENABLED, Boolean.TRUE);
 
         replay(request);
         replay(response);