title: session fixation - delete session after login and make a new session - but user is then not logged in anymore
body: <p>I use jsf2.0 and java ee6 on a JBoss AS 7</p>
  
  <p>i have a LoginController.java looking like this:</p>
  
  <pre><code>@ManagedBean(name = "loginController")
  @SessionScoped
  public class LoginController implements Serializable{
  
      private static final long serialVersionUID = 1119172305268193508L;
  
      @Inject
      private UserProvider userProvider;
  
      @PostConstruct
      public void initNewUser() {
          user = new User();
      }
  
      private User user;
  
      private String accountName;
  
      private String password;
  
      public String ownLogin() throws Exception {
  
          HttpServletRequest request = (HttpServletRequest) FacesContext.getCurrentInstance()
                  .getExternalContext().getRequest();
  
  
          if (accountName != null) {
              try {
  
  
                  if (exists(accountName)) {
  
                      user = userProvider.findUserByAccountName(accountName);
  
                      if (verifyPassword(user, password)) {
  
                          userProvider.saveChangedUser(user);
  
  
                          // OWASP SAYS: after login, destroy the session make a new one 
                          // a so called handover
                          // Destroy the session
                          FacesContext facesContext = FacesContext.getCurrentInstance();
  
                          HttpSession session = (HttpSession) facesContext.getExternalContext().getSession(false);
                          if(session != null){
                              session.invalidate();
                          }
                          // create new session after logout
                          session = (HttpSession) facesContext.getExternalContext().getSession(true);
                      setLogin(true);
              }                   
      }
  
  /* some getters and setters */
  
  }
  </code></pre>
  
  <p>The OWASP says, for security reason that after a login the sessions should be deleted (see: <a href="http://code.google.com/p/owasp-asvs/wiki/Verification_V3" rel="noreferrer">V3.7</a>)</p>
  
  <p>i do this in my code at this point:</p>
  
  <pre><code>FacesContext facesContext = FacesContext.getCurrentInstance();
  
                              HttpSession session = (HttpSession) facesContext.getExternalContext().getSession(false);
                              if(session != null){
                                  session.invalidate();
                              }
                              // create new session after logout
                              session = (HttpSession) facesContext.getExternalContext().getSession(true);
  </code></pre>
  
  <p>First, I delete the old session, then I make a new session.<br>
  After this, I set the login true...</p>
  
  <p>Of course, after running through the whole code, the user is not logged in, because the LoginController was managed in the old session scope - and in the new session scope there is a new LoginController in the scope without the loged in user...</p>
  
  <p>Is there any way, to add a new LoginController to the new session after creation?</p>
  
  <p>Or what is the common way to do it?</p>