Change session id when the user logs in.

[thiagorocha]

Hi,

I am having a problem in my app.. i need to change the session id everytime the user logs in.. it always generates the same code.. i already searched for it and didn't find anything.. and i don't know if i have to do this at jboss, seam, tomcat.. etc.. can anyone give me a hint? thanks in advance..

[amitev]

Invalidate the session after the user loggs in.

[thiagorocha]

i already did that.. and already tried to create a new one with .getSession(true) but its not working

[lvdberg]

Hi,

loggin/out is something else as having a sesion with a specific server.So while you are connected to the same server, you while have the same session. So you need to dis-connect to achieve this. Can you give us the reason why you want to do this?

If really needed you could use an additional filter.

Leo

[thiagorocha]

Leo van den Berg wrote on Nov 04, 2010 05:59:


Hi,

loggin/out is something else as having a sesion with a specific server.So while you are connected to the same server, you while have the same session. So you need to dis-connect to achieve this. Can you give us the reason why you want to do this?

If really needed you could use an additional filter.

Leo

Well.. the documentation of the software i am developing says that i need to do this.

[mwohlf]

changing sessionId is best practice against session fixation attacks, I never got this this work with seam 2, some say it is implemented in seam 3, see: https://jira.jboss.org/browse/JBSEAM-2450

[thiagorocha]

based on my searches that seems to be a problem on Jboss Server.. thanks for the link Michael