title: Veracode CWE 384 Session Fixation
body: <p>I'm fixing flaws found by veracode static scan and I found several flaws session fixation like these:</p>
  
  <ul>
  <li>request.getSession().get/set Attribute( );</li>
  </ul>
  
  <p>OWASP said I should invalidate session after logout and login but there's no login around these lines. I don't understand why it is being detected this flaw in this lines. Could you help me to understand why this is happening and how to fix it?</p>