JSESSIONID changes without any request

Question

I'm using Spring boot. And it occurs in https protocol.

When I access to the website, the JSESSION cookie is created.

After page loaded, when I refresh the Developer tools > Application > Cookies the JSESSION cookie is changed to something else without any request or redirection.

It sometimes happen, but not always.

When I use chrome's secret mode or delete chrome browsing history, it doesn't happen.

I added SameSite=None; Secure; to JSESSION cookie, but it didn't work.

What do I have to do?

user3Ag7 · Answer

Spring Security changes the session id, before you are authenticated, to another session id, after you are authenticated. That's done to prevent the "session fixation attack"

Rurien · Answer

The problem were not in my Spring boot application.

The Nginx server had two different web application on same domain.

And their JSESSIONID cookie path were same ('/').

Other web application overwrote my web application's JSESSIONID cookie.

So I asked to change Nginx config(Probably it was proxy config).

JSESSIONID changes without any request

2 Answers