Rails 3 with Authlogic and calling reset_session

Question

The RoR Security Guide states that you should "issue a new session identifier and declare the old one invalid after a successful login" using the reset_session method to counter session fixation.

I haven't been able to find any guidance on calling reset_session when using Authlogic. Is it simply a case of including the method in the controller method (as below)?

I'm just concerned about causing problems for Authlogic as I can see both user_credentials and user_credentials_id keys and values in the session hash prior to calling reset_session.

class UserSessionsController < ApplicationController

  def create
    @user_session = current_client.user_sessions.new(params[:user_session])
    if @user_session.save
      reset_session
      flash[:success] = I18n.t(:msg_login_success)
      redirect_back_or_default application_root_path
    else
      render :action => :new
    end
  end

Answer 1

For reference this is my current method:

def create
  @user_session = current_client.user_sessions.new(params[:user_session])

  if @user_session.save
    # reset session to counter session fixation
    # whilst retaining values except for those that the application has created specific to the current user
    temp_session = session.merge("current_user" => {}).clone
    reset_session
    session.reverse_merge!(temp_session)
    # set flash msg and redirect
    flash[:success] = I18n.t(:msg_login_success)
    redirect_back_or_default application_root_path
  else
    render :action => :new
  end
end

With the call to reset_session still performed after a successful login as per the recommendation in http://guides.rubyonrails.org/security.html#session-fixation-countermeasures