java或者jsp中修复会话标识未更新漏洞

<%
session.invalidate();
Cookie[] cookies=request.getCookies();
if(null!=cookies){
    for(int i=0;i<cookies.length;i++){
        if("JSESSIONID").equalsIgnoreCase(cookies[i].getName()){
            cookies[i].setMaxAge(0);
            response.addCookie(cookies[i]);
        }
    }
}
%>

<%
reponse.setHeader("Pragma","No-cache");
response.setHeader("Cache-Control","no-cache");
response.setDateHeader("Expires",0);
session=request.getSession(true);
session.invalidate();
%>

 /**
     * Called to extract the existing attributes from the session, prior to invalidating it. If
     * {@code migrateAttributes} is set to {@code false}, only Spring Security attributes will be retained.
     * All application attributes will be discarded.
     * <p>
     * You can override this method to control exactly what is transferred to the new session.
     *
     * @param session the session from which the attributes should be extracted
     * @return the map of session attributes which should be transferred to the new session
     */
    protected Map<String, Object> extractAttributes(HttpSession session) {
        return createMigratedAttributeMap(session);
    }

    final HttpSession applySessionFixation(HttpServletRequest request) {
        HttpSession session = request.getSession();
        String originalSessionId = session.getId();
        Map<String, Object> attributesToMigrate = extractAttributes(session);

        session.invalidate();
        session = request.getSession(true); // we now have a new session
        transferAttributes(attributesToMigrate, session);
        return session;
    }

<span style="font-family:Comic Sans MS;">package com.test.web.common;

import java.io.IOException;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
import java.util.Map.Entry;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import org.apache.shiro.SecurityUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class NewSessionFilter implements Filter {

    private String url;
    private static final Logger logger = LoggerFactory.getLogger(NewSessionFilter.class);
    public static final String NEW_SESSION_INDICATOR = "com.cacss.sc.web.common.NewSessionFilter";

    public static void newSession(){
        HttpSession session = (HttpSession) SecurityUtils.getSubject().getSession(true);
        session.setAttribute(NEW_SESSION_INDICATOR, true);
    }

    @Override
    public void destroy() {
        System.out.println("NewSessionFilter destory");
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        System.out.println("NewSessionFilter doFilter");
        
        if (request instanceof HttpServletRequest) {
            HttpServletRequest httpRequest = (HttpServletRequest) request;
            
            //取的url相对地址
            String url = httpRequest.getRequestURI();  
            System.out.println(url);  
            if (httpRequest.getSession() != null) {
                System.out.println("NewSessionFilter doFilter httpRequest.getSession().getId()"+ httpRequest.getSession().getId());
                //--------复制 session到临时变量
                HttpSession session = httpRequest.getSession();
                HashMap old = new HashMap();
                Enumeration keys = (Enumeration) session.getAttributeNames();
                
                while (keys.hasMoreElements()){
                    String key = (String) keys.nextElement();
                    if (!NEW_SESSION_INDICATOR.equals(key)){
                        old.put(key, session.getAttribute(key));
                        session.removeAttribute(key);
                    }
                }
                
                if (httpRequest.getMethod().equals("POST") && httpRequest.getSession() != null 
                        && !httpRequest.getSession().isNew() && httpRequest.getRequestURI().endsWith(url)){
                    session.invalidate();
                    session=httpRequest.getSession(true);
                    logger.debug("new Session:" + session.getId());
                }
                
                //-----------------复制session
                for (Iterator it = old.entrySet().iterator(); it.hasNext();) {
                    Map.Entry entry = (Entry) it.next();
                    session.setAttribute((String) entry.getKey(), entry.getValue());
                }
            }
        }
        
        chain.doFilter(request, response);
        System.out.println("NewSessionFilter doFilter end");
    }

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        System.out.println("NewSessionFilter init");
        System.out.println("NewSessionFilter init end");
    }

}</span>

<span style="font-family:Comic Sans MS;"><filter>
    <filter-name>NewSessionFilter</filter-name>
    <filter-class>com.cacss.sc.web.common.NewSessionFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>NewSessionFilter</filter-name>
    <url-pattern>/login</url-pattern>
</filter-mapping>

</span>