httpservletrequest - create new session / change session Id

Question

I'm maintaining a Java web application.

Looking into the login code it gets an HttpSession out of HttpServletRequest via the getSession() method of HttpServletRequest. (It uses some values in the session for authentication purposes)

However I'm worried about session fixation attacks so after I have used the initial session I want to either start a new session or change the session id. Is this possible?

Answer 1

You can invalidate a session like this

request.getSession(false).invalidate();

and then create a new session with getSession(true) (getSession() should work to)

Answer 2

did this work out for you? When I do the following (to prevent session fixation):

HashMap<String, Object> attributes = new HashMap<String, Object>();
// copy/save all attributes
Enumeration<String> enames = httpSession.getAttributeNames();
while ( enames.hasMoreElements() )
{
  String name = enames.nextElement();
  if ( !name.equals( "JSESSIONID" ) )
  { 
    attributes.put( name, httpSession      
     .getAttribute( name ) );
  }      
}
// invalidate the session
httpSession.invalidate();
// create a new session
httpSession = request.getSession( true );
// "restore" the session values
for ( Map.Entry<String, Object> et : attributes.entrySet() )
{
  httpSession.setAttribute( et.getKey(), et.getValue() ); // <- java.lang.IllegalStateException: setAttribute: Session already invalidated
}

I get "java.lang.IllegalStateException: setAttribute: Session already invalidated" What am I missing?

Answer 3

I have tried after invalidate the session then create the new session, but it is giving the same session id in websphere server environment. could you please help me.