I am using Spring Boot 2.7.18 with Spring Session and MySQL to store sessions in the database, and my frontend is built with Angular. After logging in and being redirected back to my Angular app, the session ID changes, and a new session is created in both the browser (under the "Application" tab) and the MySQL database. This happens even though I expect the same session to persist between requests, causing the session to be recreated every time the user is redirected, which breaks session persistence.
Flow overview:
so at the first step, there is a certain session id, then at the last, this id changed. I don't understand why, or if we i'm trying is possible.
Changing the sessionId
upon authentication is a common practice to prevent session fixation attacks. Spring Security has support for configuring the behavior. By default it should keep the session contents, but change the sessionId
.