SessionRotate(): Do you always use this after a successful sign on? Docs say it helps to prevent hacking.

We use Use J2EE session variables, so it doesn't apply.

Yes, this is generally a good idea, since it will create a new session token, after authentication. By not refreshing the session, this may make it easier for an attacker to obtain a "will-be-valid-in-the-future" session token

I have this in testing now, but so far it looks like it will work to solve the problem we are having with duplicated sessions.

it is a good idea for avoiding session fixation attacks

And the other side of this is to always have the "logout" action destroy/invalidate the session on the server-side, not just clear the cookies in the client's browser

@Dave Merrill JEE sessions can also be rotated, though it takes some coding. We do so on Lucee.

@foundeo is the JEE session rotating code in that 2014 blog post still a safe-to-use approach?

yeah, still the only way to do it as far as I know

here's the relevant ticket https://luceeserver.atlassian.net/browse/LDEV-1105