session fixation protection

src/main/java/io/jenkins/plugins/MfaVerifyAction.java

@@ -18,7 +18,9 @@ import hudson.Extension;
 import hudson.model.RootAction;
 import hudson.model.User;
 import java.io.IOException;
+import java.util.logging.Level;
 import java.util.logging.Logger;
+import javax.servlet.http.HttpSession;
 import org.kohsuke.stapler.StaplerRequest;
 import org.kohsuke.stapler.StaplerResponse;
 
@@ -51,15 +53,30 @@ public class MfaVerifyAction implements RootAction {
      */
     public void doVerify(StaplerRequest req, StaplerResponse rsp) throws IOException {
         User u = User.current();
+
         if (u == null) {
             rsp.sendRedirect(req.getContextPath() + "/login");
             return;
         }
+
         MfaUserProperty mfa = u.getProperty(MfaUserProperty.class);
+
         if (mfa != null && mfa.isMfaEnabled()) {
             String code = req.getParameter("totpCode");
             if (TOTPUtil.verifyCode(mfa.getSecretKey(), code)) {
-                req.getSession().setAttribute("mfa-verified", true);
+                HttpSession session;
+                try {
+                    // Session Fixation protection
+                    session = req.getSession();
+                    session.invalidate(); // invalidate current session
+                    session = req.getSession(true); // create new session
+                } catch (IllegalStateException e) {
+                    LOGGER.log(Level.WARNING, "Error during session regeneration", e);
+                    session = req.getSession(true); // fallback - just get/create session
+                }
+
+                // Set verification flag on the NEW session
+                session.setAttribute("mfa-verified", true);
                 rsp.sendRedirect(req.getContextPath() + "/");
                 return;
             } else {
@@ -67,7 +84,8 @@ public class MfaVerifyAction implements RootAction {
                 return;
             }
         }
-        // Se usuário não tem MFA, apenas redireciona
+
+        // Without MFA, redirect
         rsp.sendRedirect(req.getContextPath() + "/");
     }
 }