Search code examples
javavert.xsession-fixation

Vert.x Web and session fixation


Using Vert.x Web handlers is it possible to fix session fixation problems (ie change the session id after user is authenticated), or do I have to implement my own session handling? I need a session during login handling, and I don't see how to create a new session with authentication tokens (or change the session id).


Solution

  • Vertx session id is regenerated when an upgrade from unauthenticated to authenticated happens.

    You can request a new I'd atbany time with the method: Session.regenerateId()