The conversation id must go with the request. It can go in the URL or it can be transmitted with the view data in a normal JSF POST. It obviously can't be stored in the HTTP session, because then you could have only one conversation per session. In theory it could go in a cookie if web browsers implemented conversational cookies, but they don't.

But, actually, that's not a bad idea. It would be nice if cookies could be marked as "conversational" and would be transmitted on subsequent requests only on clicks/requests from the page that originated the conversation.

It would also solve the general cookie problem because users who are paranoid could turn of cookies completely. There would be no privacy harm in using conversation cookies, because they would never be persisted by the browser, could never be used to transfer data between websites and the user could be sure that when he closed a window that his "state" would be gone. (think public internet access, etc...)

Oh - no idea how apache URL rewriting would affect things. In general, I would suggest that it is a bad practice, but that's just my opinion. :)

Check this out: http://tuckey.org/urlrewrite/
URL rewriting through a filter. This doesn't solve the problem by itself, but it brings the filtering closer to seam.

I have been experimenting with that urlrewrite and I really like it. I'd like to see more support in seam for controlling the look of the URLs, but it is, as of yet, a low priority thing.