Abstract: A modified Web server comprises a session manager which intercepts all incoming requests from clients for Web pages. Each request incorporates a token which the session manager compares with tokens which are stored in a session store. On finding a matching token, a URL associated with the matching token is used by the Web server to return a Web page indicated by the URL to the requester. Any URLs embedded in the Web page to be returned are tokenised by the session manager before the page is returned, and the resulting token/URL pair is stored in the session store.