GrizzlySessionManager implements SessionManager { @Override public String changeSessionId(final Request request, final Session session) { String oldId = session.getIdInternal(); GrizzlySession grizzlySession = (GrizzlySession) session; SessionFactory sessionFactory = sessionFactoryProvider.get(); org.hibernate.Session hibernateSession = sessionFactory.openSession(); try { BigInteger old = IdUtil.fromString(session.getIdInternal()); hibernateSession.beginTransaction(); HttpSession oldEntity = hibernateSession.get(HttpSession.class, old); hibernateSession.getTransaction().commit(); if (oldEntity != null) { hibernateSession.beginTransaction(); List<OAuthToken> refreshTokens = new ArrayList<>(oldEntity.getRefreshTokens()); HttpSession newSession = new HttpSession(); newSession.setSessionTimeout(session.getSessionTimeout()); newSession.setRefreshTokens(refreshTokens); hibernateSession.delete(oldEntity); hibernateSession.save(newSession); hibernateSession.getTransaction().commit(); grizzlySession .setIdInternal(IdUtil.toString(newSession.getId())); } } catch (Exception e) { hibernateSession.getTransaction().rollback(); } hibernateSession.close(); return oldId; } @Inject  GrizzlySessionManager(final SystemConfiguration c,
                                 final Provider<SessionFactory> sfProvider); @Override Session getSession(final Request request,
                              final String requestedSessionId); @Override Session createSession(final Request request); @Override String changeSessionId(final Request request,
                                  final Session session); @Override String getSessionCookieName(); @Override void setSessionCookieName(final String name); @Override void configureSessionCookie(final Request request,
                                       final Cookie cookie);  }
@Test public void testChangeSessionId() { org.hibernate.Session hSession = getSession(); HttpSession s = new HttpSession(); s.setSessionTimeout(1000); hSession.beginTransaction(); hSession.save(s); hSession.getTransaction().commit(); hSession.evict(s); Session browserSession = manager.asSession(s); String oldId = manager.changeSessionId(null, browserSession); assertEquals(s.getId(), IdUtil.fromString(oldId)); hSession.beginTransaction(); HttpSession testSession = hSession.get(HttpSession.class, s.getId()); hSession.getTransaction().commit(); assertNull(testSession); assertNotEquals(oldId, browserSession.getIdInternal()); hSession.beginTransaction(); HttpSession newSession = hSession.get(HttpSession.class, IdUtil.fromString(browserSession.getIdInternal())); hSession.getTransaction().commit(); assertNotNull(newSession); assertEquals(s.getSessionTimeout(), newSession.getSessionTimeout()); assertNotEquals(s.getCreatedDate(), newSession.getCreatedDate()); assertNotEquals(s.getModifiedDate(), newSession.getModifiedDate()); }