For the following code?I was able to create a new Session ID under Tomcat5.5. However, Session ID was the same under JBoss4.21GA. session = request.getSession(true); | out.println("session id=" + session.getId()); | | request.getSession(true).invalidate(); | session = request.getSession(true); | out.println("session id=" + session.getId()); To prevent Session Fixation Attack , I hope to create a new Session ID after the Login process. If it is possible, could you please tell me the way ? Thank you. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4101250#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...