A customer has requested some security enhancements to our Java web application, including the following:
According to our security team good security practices state that
session id should be changed on every request to prevent session
hijacking.
I understand the importance of allocating a new session ID upon authentication (which we already do), but this request seems a bit extreme.
If reallocating on a per-request basis, it sounds like it’s no longer a session ID, but rather a single-use request ID that might be used in conjunction with a session ID.
So, my question: is such a tactic really a common security practice? If so, could somebody point me to a good discussion on the topic, implementation tips, etc.?
It doesn’t hurt, but it can be really complicated and really you only need to re-generate the session id when the security level changes. See also Session Hijacking – regenerate session ID on Security StackExchange.