title: We have observed that user1 can get access of USER2 just by changing the session Id
body: <p>i am facing one issue like if i copy session_id from user1  and use same session-id in USER2</p>
  
  <p>then my session is hijacking from user1 to user2,
  I am using Java, tomcat, hibernate , javascript, rest API</p>
  
  <p>any idea how to resolve this issue.</p>