A customer has requested some security enhancements to our Java web application, including the following:

> 
> According to our security team good security practices state that
>  session id should be changed on every request to prevent session
>  hijacking.
> 
> 
> 

I understand the importance of allocating a new session ID upon authentication (which we already do), but this request seems a bit extreme.

If reallocating on a per-request basis, it sounds like it's no longer a session ID, but rather a single-use request ID that might be used in conjunction with a session ID.

So, my question: is such a tactic really a common security practice? If so, could somebody point me to a good discussion on the topic, implementation tips, etc.?