title: Changing JSESSION ID with Tomcat 7
body: <p>According to the tomcat docs, tomcat7 is not vulnerable to session fixation attack. But my tomcat 7.0.25 as well as 7.0.27 is vulnerable to this attack. JSESSIONID cookie value is not getting changed on successful login.</p>
  
  <p>I added following Valves to my conf/context.xml. But this didn't work. Please help me.</p>
  
  <pre><code>&lt;Valve className="org.apache.catalina.authenticator.BasicAuthenticator" changeSessionIdOnAuthentication="true" /&gt;
  &lt;Valve className="org.apache.catalina.authenticator.SSLAuthenticator" changeSessionIdOnAuthentication="true" /&gt;
  &lt;Valve className="org.apache.catalina.authenticator.SpnegoAuthenticator" changeSessionIdOnAuthentication="true" /&gt;
  &lt;Valve className="org.apache.catalina.authenticator.DigestAuthenticator" changeSessionIdOnAuthentication="true" /&gt;
  &lt;Valve className="org.apache.catalina.authenticator.FormAuthenticator" changeSessionIdOnAuthentication="true" /&gt;
  </code></pre>
  
  <p>I have also come to know that JSESSION ID cookie value only changes on authentication. What does authentication means ? Is it switching the application from http to https ?</p>
  
  <p>Is there anything already built which can change the the jsession id value on login ? Right now I am changing this via code.</p>
  
  <p>Thanks in advance. Please let me know if you need more info.</p>
  
  <p>Regards,</p>
  
  <p>Prashant Gupta </p>