(wicket) branch wicket-10.x updated: Changing session id after binding.

[adelbene]

This is an automated email from the ASF dual-hosted git repository.

adelbene pushed a commit to branch wicket-10.x
in repository https://gitbox.apache.org/repos/asf/wicket.git


The following commit(s) were added to refs/heads/wicket-10.x by this push:
     new 1fc14d4446 Changing session id after binding.
1fc14d4446 is described below

commit 1fc14d4446ebed9bd962b2609c073a81331454e0
Author: Andrea Del Bene <adelb...@apache.org>
AuthorDate: Sun Mar 29 22:00:15 2026 +0200

    Changing session id after binding.
---
 .../apache/wicket/authroles/authentication/AuthenticatedWebSession.java  | 1 +
 1 file changed, 1 insertion(+)

diff --git 
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/AuthenticatedWebSession.java
 
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/AuthenticatedWebSession.java
index 8cd97c0dfa..5438cfba95 100644
--- 
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/AuthenticatedWebSession.java
+++ 
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/AuthenticatedWebSession.java
@@ -71,6 +71,7 @@ public abstract class AuthenticatedWebSession extends 
AbstractAuthenticatedWebSe
                }
                else if (authenticated && signedIn.compareAndSet(false, true))
                {
+                       changeSessionId();
                        bind();
                }
                return authenticated;