title: Security: Session Identifier Not Updated in tcl
body: <p>I'm working on open-source application <a href="http://project-open.org/" rel="nofollow">"Project-Open"</a> and during the scanning I got the following vulnerability:</p>
  
  <pre><code>[Medium] Session Identifier Not Updated
  Issue: 13800882
  Severity: Medium
  URL: https://&lt;server_name&gt;/register/
  Risk(s): It is possible to steal or manipulate customer session and cookies, which might be used to impersonate a legitimate user,allowing the hacker to view or alter user records, and to perform transactions as that user
  Fix: Do not accept externally created session identifiers
  </code></pre>
  
  <p>though the fix is mentioned but it is not sufficient for me to understand it completely.please guide me how should I remove this.Also let me know if any further details are needed to understand the question.
  The project source code is in tcl              </p>
  
  <p>I found the following code which does the same but it's in java. </p>
  
  <pre><code>  public HttpSession changeSessionIdentifier(HttpServletRequest request) throws AuthenticationException {
  
       // get the current session
          HttpSession oldSession = request.getSession();
  
       // make a copy of the session content
          Map&lt;String,Object&gt; temp = new ConcurrentHashMap&lt;String,Object&gt;();
          Enumeration e = oldSession.getAttributeNames();
          while (e != null &amp;&amp; e.hasMoreElements()) {
                 String name = (String) e.nextElement();
                 Object value = oldSession.getAttribute(name);
                 temp.put(name, value);
          }
  
       // kill the old session and create a new one
          oldSession.invalidate();
          HttpSession newSession = request.getSession();
          User user = ESAPI.authenticator().getCurrentUser();
          user.addSession( newSession );
          user.removeSession( oldSession );
  
       // copy back the session content
          for (Map.Entry&lt;String, Object&gt; stringObjectEntry : temp.entrySet()){
               newSession.setAttribute(stringObjectEntry.getKey(),       stringObjectEntry.getValue());
           }
    return newSession;
  </code></pre>
  
  <p>}</p>
  
  <p>P.S. I'm newbie in TCL.
  please let me know if you need any further explanation.</p>