how to refresh JSESSIONID cookie after login

Question

A product I work on got a tough security audit by a potential customer and they are upset that Tomcat sets a JSESSIONID cookie before authentication has happened. That is, Tomc

Answer 1

When using spring, you should use SessionFixationProtectionStrategy.

...

When inspecting the source code, you will see that this is similar to the approach of harsha89: It will

1. create a new session
2. tranfer attributes of the old session.