1

I am using resin app server request.getSession.invalidate();reguest.getSession(true) is not working properly and its not resetting session ID while using Resin.

Also I am not able to use request.changeSessionId() as the resin version is not able to use JavaEE7 libraries.

Please share your views on how to resolve session fixation with Resin

dreambigcoder
  • 1,859
  • 4
  • 22
  • 32

1 Answers1

1

Resin 4.0.x doesn't implement Servlet 3.1 API.

Resin provides reuse-session-id configuration option that helps control session cookie behaviour.

http://caucho.com/resin-4.0/reference.xtp#session-config

Incarnate1970th
  • 202
  • 2
  • 7