Search code examples
sessionjboss

jsessionid from wrong session is getting set in cookie fro JBOSS7.2

For session fixation prevention we have added oldsession.invalidate(); newSession = req.getSession(true); Here jboss is setting same cookie (from invalidated session) as JSESSIONID

Solution
    • Issue, was with Session Fixation prevention code.
    • Here we were invalidation session by, oldSession.inValidate();
    • and then we were getting new session. request.getSession(true);

    Solution to this is, - inValidate session in new thread, and make current thread wait for its execution.