title: Session fixation in Spring Security
body: <p>We are trying to prevent session fixation attack in our application. This means we are expected to generate new <code>JSESSIONID</code> every time a user logs into application. </p>
  
  <p>Current scenario doesn't generate new <code>JSESSIONID</code> post authentication with ADFS (Active directory). Thus we would like to achieve the same. Can you let us know, how to achieve solution for this kind of attack? </p>
  
  <p>We have Spring, Primefaces and Spring Security used in our application. We tried implementing below tags in our Spring <code>security.xml file</code>. However, it doesnt seem to generate new <code>JSESSIONID</code> post authentication is successful with ADFS. This <code>spring-security.xml</code> has been added in <code>web.xml</code>. Can you let us know what is wrong with below use? We are using Spring Security 3.2.10 in project.</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;sec:http create-session="always" use-expressions="true"&gt;
          &lt;sec:intercept-url pattern="/*" /&gt;
          &lt;sec:http-basic /&gt;
          &lt;sec:session-management invalid-session-url="/"
              session-fixation-protection="newSession"&gt;
              &lt;sec:concurrency-control max-sessions="150"
                  expired-url="/" /&gt;
          &lt;/sec:session-management&gt;
          &lt;sec:csrf/&gt;
      &lt;/sec:http&gt;
      &lt;sec:authentication-manager alias="authenticationManager"&gt;
          &lt;sec:authentication-provider&gt;
              &lt;sec:user-service&gt;
                  &lt;sec:user name="abc" password="abc" authorities="ROLE_USER" /&gt;
              &lt;/sec:user-service&gt;
          &lt;/sec:authentication-provider&gt;
      &lt;/sec:authentication-manager&gt;
  </code></pre>