Exam 312-96 topic 1 question 17 discussion

In Spring Security, the configuration setting that helps protect against session fixation attacks by migrating the session after the user is authenticated is migrateSession. When this setting is used, Spring Security will ensure that a new session is created upon authentication, thereby invalidating the old session and mitigating the risk of session fixation attacks. So the correct answer is: B. session-fixation-protection ="migrateSession" Here's how you might use it in XML-based Spring Security configuration: <session-management session-fixation-protection="migrateSession" /> The other options are not standard settings for session fixation protection in Spring Security: newSessionID: This is not a standard Spring Security setting for session fixation protection. enabled: While enabling session management is important, this specific value is not used for session fixation protection in Spring Security. protectSession: This is not a standard Spring Security setting for session fixation protection. Therefore, migrateSession is the correct choice for protecting against session fixation attacks by ensuring that authenticated users get a new session.