How to prevent tomcat session hijacking?

Question

In my web.xml I\'ve defined a user-data-constraint for some resources:

Answer 1

I suggest to change the sessionId when you authenticate the session.
In this way the old sessionId becomes useless and session hijacking is impossible.
To change the sessionId in a servlet container:

• copy all the attributes of the current session on a temp collection
• session.invalidate()
• session = req.getSession(true)
• fill the new session with the attributes from the temp collection

About SSLID, please note that both client and server are free to close the connection at any time. When closed a new SSL handshake will happen and a new SSID generated. So, IMO SSLID is not a reliable way to track (or help to track) sessions.