title: How to create a new cookie for new logged user inSpring Security
body: <p>I'm using spring security 3.0 with Spring MVC. My Java Web application is a Shopping cart. I'm using a Service that store a shopping list in session, When User A create a shopping list, and then proceed to logout and login again, the shopping list is restored as normal, but if another User B go to the same Application, using the SAME browser and proceed to login, the session is restored using the Shopping list of User A!.</p>
  
  <p>What I can understand is that the JSESSION cookie doesn't change when user A logout in the same browser. That is the reason that if User A login to the application using another browser, he doesn't have the same session data, the JSESSION cookie is different.</p>
  
  <p>I'm using my own authentication success handler for login and logout.</p>
  
  <pre><code>    &lt;http auto-config="true" use-expressions="true"&gt;
      &lt;intercept-url pattern="/index.html" access="permitAll"/&gt;
      &lt;form-login login-page="/index.html"
                default-target-url="/index.html"
                authentication-success-handler-ref = "loginSuccessHandler"
                /&gt;
  
      &lt;logout  invalidate-session="false" logout-url="/logout" success-handler-ref="logoutSuccessHandler" /&gt;
     &lt;!-- &lt;logout  invalidate-session="false" success-handler-ref="logoutSuccessHandler" /&gt; --&gt;
  &lt;/http&gt;
  </code></pre>
  
  <p>And yes using invalidate-session = "true" might be a short-time solution, but in this way I cannot use data saved in session.</p>
  
  <p>What i want is that when UserA log in a browser, save some data to session (the shopping list), and then logout, make UserB have his own session, instead of using the session of UserA, i suspect that the answer is in asigning a new cookie to userB, but also, to asign the old cookie to UserA.  </p>