Configuring session fixation protection
As we are using the security namespace style of configuration, session fixation protection is already configured on our behalf. If we wanted to explicitly configure it to mirror the default settings, we would do the following:
http.sessionManagement(session -> session.sessionFixation().migrateSession());
Session fixation protection is a feature of the framework that you most likely won’t even notice unless you try to act as a malicious user. We’ll show you how to simulate a session-stealing attack; before we do, it’s important to understand what session fixation does and the type of attack it prevents.
Understanding session fixation attacks
Session fixation is a type of attack whereby a malicious user attempts to steal the session of an unauthenticated user of your system. This can be done by using a variety of techniques that result in the attacker obtaining the unique session identifier of the user (for example...
