Spring Security - Third Edition

Preventing session fixation attacks with Spring Security

If we can prevent the same session that the user had prior to authentication from being used after authentication, we can effectively render the attacker's knowledge of the session ID useless. Spring Security session fixation protection solves this problem by explicitly creating a new session when a user is authenticated and invalidating their old session.

Let's take a look at the following diagram:

We can see that a new filter, o.s.s.web.session.SessionManagementFilter, is responsible for evaluating if a particular user is newly authenticated. If the user is newly authenticated, a configured ...