session id change and attributes copying after login

Question

My application use java servlets,jsp and tomcat 6. I like to implement session id change and want to copy the old session attributes to the new one after login. We started using a little bit of spring in this. Which is the best way to add this feature to a 10 year old application like this.

Answer 1

If you use Spring Security, the framework should change the session id after login by default.

@see Spring Security FAQ:

Why does the session Id change when I authenticate through Spring Security?

With the default configuration, Spring Security invalidates the existing session when the user authenticates and creates a new one, transferring the session data to it. The intention is to change the session identifier to prevent “session-fixation” attacks. You can find more about this online and in the reference manual

---

If you do not use Spring (Security) you have to do it by your own. A bit in this way:

public class Login extends HttpServlet {
...
    HttpSession session = request.getSession();
    Map<String,Object> values = session.GetAll(); //This line is psydo code
    //Use getValueNames() and a loop with getValue(String name);

    // Kill the current session
   session.invalidate();

   HttpSession newSession = request.getSession(true);
   newSession.putAllValues(values); //This line is psydo code
...