title: Creating a new JSESSIONID after authentication
body: <p>When a user hits login page of a <code>Portal</code> (it could be <code>Liferay</code>, <code>Jboss Portal</code>..),  <code>JSESSIONID  cookie</code>is created by the <code>container</code>. After entering credentials in the login page, same <code>JSESSIONID</code> gets carried over. </p>
  
  <p>Here, end user will come to know the <code>JSESSIONID</code>before he could get authenticated (by checking the <code>JSESSIONID</code> in the login page). This will increase vulnerability of the site for hacking because one can know the <code>JSESSIONID</code>  before one gets authenticated. </p>
  
  <p>This <a href="https://stackoverflow.com/questions/4722151/what-is-the-vulnerability-of-having-jsessionid-on-first-request-only">post</a> advices to have a different <code>JSESSIONID</code> after authentication. </p>
  
  <p>So, creating a new JSESSIOND can be achieved by <code>Portal</code> server being used (am using <code>Liferay CE 6.0</code>) or it has to be handled by web application developer? If it has to be handled by web application developer what is the best way to do?  <code>request.getSession(true)</code> is the only option?? If I need to instruct <code>Liferay</code> to create a new <code>JSESSIONID</code> after authentication how it can be done?</p>