Fix Shiro session ID not updated issue

to resolve a security issue where the session ID is not updated, you will need to generate a new session during login verification, so the previous session must be invalidated.

The general solution is as follows:

public void Login (HttpServletRequest request, ...) {     //Let old session fail     Request.getsession (True). Invalidate ();     Login Verification}

However, if you use the Shiro framework, this will cause an error: ... Session already invalidated. The reason is Shiro to httpsession a layer of packaging, you directly let the original session invalidation, without notice Shiro,shiro again to use the session will be an error. Workaround, instead of using native invalidation methods, use the API method provided by Shiro itself: Securityutils.getsubject (). Logout ();

public void Login (String username,string password) {     //Let old session fail     Securityutils.getsubject (). Logout ();     Login Verification}

Fix Shiro session ID not updated issue