How to reset JSESSIONID

Question

It is considered a good security practice to reset the session cookie when a user authenticates.

How to do this with Java?

My attempt so far is successful, but I was wondering if there's a better way:

public static HttpSession resetSessionId(HttpSession session, 
      HttpServletRequest request) {
    session.invalidate();
    session = request.getSession(true);
    return session;
}

Answer 1

I only pass the request from which I get the session. If a session doesn't yet exist there is no point in creating one just to invalidate it. This also holds if the session has just been created by the container (due to the user first http request directly on the login form).

public static ... (HttpServletRequest request) { 
    HttpSession session = request.getSession(false);
    if (session!=null && !session.isNew()) {
        session.invalidate();
    }

Answer 2

Your answer seems optimal. Another way would be to directly manipulate cookes in this fashion:

 Cookie cookie = new Cookie ("JSESSIONID", "randomValue");
 cookie.setMaxAge( 0 );

so you create a new cookie with the same name and immediately expire it, but I don't recommend going this way since yours is much cleaner and pretty obvious to anyone who's familiar with basic Servlet APIs.

Answer 3

Tomcat (since 6.0.24 AFAIK) can change the sessionId on authentication automatically - as long as you're using standard servlet authentication mechanisms (basic, form based authentication). This can be configured via changeSessionIdOnAuthentication for the Basic Authenticator Valve: http://tomcat.apache.org/tomcat-6.0-doc/config/valve.html