Re : PCI compliance, What you should know.

Yes it is generally the server which issues the Session IDs, unless the application is coded to create those specifically.

Michael Evangelista
Cartweaver ColdFusion Lead Developer
--
ColdFusion Reseller Hosting
http://www.GoWestHosting.com