A modern programming language that makes developers happier.

kotlinlang

Is there a good way to rotate a session ID for a Session in the ktor Sessions plugin? According to the OWASP Guidelines (<https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#renew-the-session-id-after-any-privilege-level-change|cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#…>) It is recommended to rotate the session ID after privilege level changes (for example, unauthed => authed), in case an attacker has previously captured the session cookie.

The only way with Ktor Sessions I have found this to work is by using
```val SESSION_PLUGIN_SESSION_ATTRIBUTE_KEY = AttributeKey<String>("SessionId")

val session = call.sessions.get<MySession>()
call.sessions.clear<MySession>()
call.attributes.remove(SESSION_PLUGIN_SESSION_ATTRIBUTE_KEY)
call.sessions.set(session)```
Which is quite hacky and I have not even checked so far for side effects.
Is there a better way for this?

Previously reported here: <https://youtrack.jetbrains.com/issue/KTOR-675/Regenerate-session-id?_gl=1*1rsp6or*_gcl_au*ODE1Njk4NDY1LjE3ODc4MzQ0ODU.*_ga*MTM1NzY1NzAyOS4xNzUzNDI4MDMz*_ga_9J976DJZ68*czE3OTAzNDExNzgkbzE0OSRnMCR0MTc5MDM0MTE3OCRqNjAkbDAkaDA|youtrack.jetbrains.com/issue/KTOR-675/Regenerate-session-id?_gl=…>.
For reference: the attribute key is taken from here: <https://github.com/ktorio/ktor/blob/d08fd0382b2acf314b2beb430b66ba148845a892/ktor-server/ktor-server-plugins/ktor-server-sessions/common/src/io/ktor/server/sessions/SessionTrackerById.kt#L116|github.com/ktorio/ktor/blob/…/SessionTrackerById.kt#…>

I don't see any better options because the session ID manipulation is hidden from the consumer.