title: httpservletrequest - create new session / change session Id
body: <p>I'm maintaining a Java web application.</p>
  
  <p>Looking into the login code it gets an HttpSession out of HttpServletRequest via the getSession() method of HttpServletRequest. (It uses some values in the session for authentication purposes)</p>
  
  <p>However I'm worried about session fixation attacks so after I have used the initial session I want to either start a new session or change the session id. Is this possible?</p>