web/src/main/java/org/springframework/security/web/authentication/session/AbstractSessionFixationProtectionStrategy.java
protected void onSessionChange(String originalSessionId, HttpSession newSession,
			Authentication auth) {
		applicationEventPublisher.publishEvent(new SessionFixationProtectionEvent(auth,
				originalSessionId, newSession.getId()));
	}
protected void onSessionChange(String originalSessionId, HttpSession newSession,
			Authentication auth) {
		applicationEventPublisher.publishEvent(new SessionFixationProtectionEvent(auth,
				originalSessionId, newSession.getId()));
	}
Called when the session has been changed and the old attributes have been migrated
to the new session. Only called if a session existed to start with. Allows
subclasses to plug in additional behaviour. *
<p>
The default implementation of this method publishes a
{@link SessionFixationProtectionEvent} to notify the application that the session
ID has changed. If you override this method and still wish these events to be
published, you should call {@code super.onSessionChange()} within your overriding
method.

@param originalSessionId the original session identifier
@param newSession the newly created session
@param auth the token for the newly authenticated principal