JRun session id being re-used

Question

We are using JRun 4.0 on our server in conjunction with MS
IIS 6.0 to support dynamic JSP pages and Java Serlvets. We are
using URL Encoding to support session handling. In the jrun-
web.xml file we have the following parameters to disable the use of
cookies for session handling.
<session-config>
<cookie-config>
<active>false</active>
</cookie-config>
</session-config>
With these parameters defined in the jrun-web.xml file, and
the use of response.encodeURL() function, we see that jrun
automatically appends a jsessionid=xxxxxxx parameter in the urls.
This has been working for us well since long. Recently we noticed
that these jsessionid values are being re-used by jrun for
different session instances. Which means if a user logs in to a
website at a given time and is assigned a sessionid say for e.g.
101011 and after a while the user logs out. After some time if
another user logs in, this second user is assigned the same
sessionid parameter (which has a value 101011) for handling his
session. If in case the first user has bookmarked the a page on the
website, the bookmark is going to include the sessionid parameter
(which has a value 101011) and if the first user accesses the
website from the bookmark at the same time as the second user is
logged in, the first user will get access to the second user's
session which is very unsecure.
This phenomena is referred to as session fixation and can be
used by a hijacker to get access to any other user's session. Is
there a way to prevent JRun from re-using these session id values
or to increase the time period after which JRun re-uses these
session ids.

Answer 1

Dax Trajero wrote:
... how do I prevent a user who's just ordered, from returning to the site and re-using the same session ref ?
Deny a returning paying(!) customer his session? Yours might be the only shop in town doing that.
If your session housekeeping is any good, then the session variables  pertaining to shopping-cart, payment and delivery would have been  cleared or re-initialized. Often, starting a new session means logging in again. There are a number of reasons why that can be undesirable.
I did an e-commerce course for a year, and learned some strange things. It is in fact to your advantage that a returning customer should keep his session, even after ordering.
For example, it is well known that the chances of a returning customer placing a new order is much higher when he is already logged in than when he has to log in afresh. You could test that hypothesis yourself. Psychologists have also found that e-shoppers often return to the shop to gloat at the goodies they've just ordered. You wouldn't want to deny them their gloating session, would you?