web/src/main/java/org/springframework/security/web/authentication/session/AbstractSessionFixationProtectionStrategy.java
protected void onSessionChange(String originalSessionId, HttpSession newSession,
			Authentication auth) {
		applicationEventPublisher.publishEvent(new SessionFixationProtectionEvent(auth,
				originalSessionId, newSession.getId()));
	}
protected void onSessionChange(String originalSessionId, HttpSession newSession,
			Authentication auth) {
		applicationEventPublisher.publishEvent(new SessionFixationProtectionEvent(auth,
				originalSessionId, newSession.getId()));
	}
protected void onSessionChange ( String originalSessionId , HttpSession newSession , Authentication auth ) { applicationEventPublisher . publishEvent ( new SessionFixationProtectionEvent ( auth , originalSessionId , newSession . getId ( ) ) ) ; }
Called when the session has been changed and the old attributes have been migrated
to the new session. Only called if a session existed to start with. Allows
subclasses to plug in additional behaviour. *
<p>
The default implementation of this method publishes a
{@link SessionFixationProtectionEvent} to notify the application that the session
ID has changed. If you override this method and still wish these events to be
published, you should call {@code super.onSessionChange()} within your overriding
method.

@param originalSessionId the original session identifier
@param newSession the newly created session
@param auth the token for the newly authenticated principal
Called when the session has been changed and the old attributes have been migrated to the new session . Only called if a session existed to start with . Allows subclasses to plug in additional behaviour . * <p > The default implementation of this method publishes a { @link SessionFixationProtectionEvent } to notify the application that the session ID has changed . If you override this method and still wish these events to be published you should call { @code super . onSessionChange () } within your overriding method .