title: Good practice to allocate new session ID on each request?
body: <p>A customer has requested some security enhancements to our Java web application, including the following:</p>
  
  <blockquote>
    <p>According to our security team good security practices state that
    session id should be changed on every request to prevent session
    hijacking.</p>
  </blockquote>
  
  <p>I understand the importance of allocating a new session ID upon authentication (which we already do), but this request seems a bit extreme.</p>
  
  <p>If reallocating on a per-request basis, it sounds like it's no longer a session ID, but rather a single-use request ID that might be used in conjunction with a session ID.</p>
  
  <p>So, my question: is such a tactic really a common security practice? If so, could somebody point me to a good discussion on the topic, implementation tips, etc.?</p>