title: Session ID re-used after call to invalidate
body: <p>I've inherited a pretty ancient JSP application (JDK 1.3.1_15) and am attempting to plug a session fixation hole.</p>
  
  <p>I'm successfully invalidating the current session after authentication using <code>HttpSession.invalidate()</code> however when the new session is created, the old session ID is re-used.</p>
  
  <pre><code>&lt;%
  // login.jsp
  if (authenticated) {
      request.getSession().invalidate();
  
      // create new session and store data
      HttpSession session = request.getSession();
      session.putValue(...);
      // etc
  
      response.sendRedirect("logged-in.jsp");
      return;
  }
  %&gt;
  </code></pre>
  
  <p>I can see the new session assignment in my HTTP monitor, it's just using the same number again.</p>
  
  <pre><code>-- Initial request response --
  HTTP/1.1 200 OK
  Set-Cookie: JSESSIONID=6a303082951311647336934;path=/
  
  -- login.jsp request response --
  HTTP/1.1 302 Moved Temporarily
  Location: http://example.com/logged-in.jsp
  Set-Cookie: JSESSIONID=6a303082951311647336934;path=/
  </code></pre>
  
  <p>Prior to me using <code>session.invalidate()</code> the second <code>Set-Cookie</code> response header was not present at all.</p>
  
  <p>Does anybody have any advice on how to generate a new session ID? I'm not very familiar with JRUN4 but trawling through the configuration documentation hasn't turned up anything.</p>