我注意到，当使用自定义安全过滤器登录后，jsessionid不会改变。

@Override
  protected void configure(HttpSecurity http) throws Exception {
    http
      .addFilterBefore(authenticationFilter(), UsernamePasswordAuthenticationFilter.class)
      .authorizeRequests()
      .antMatchers("/", "/home").permitAll()
      .anyRequest().authenticated()
      .and()
      .formLogin()
      .loginPage("/login")
      .permitAll()
      .and()
      .logout()
      .permitAll();
  }

  public UsernamePasswordAuthenticationFilter authenticationFilter() throws Exception {
    CustomFilter customFilter = new CustomFilter();
    customFilter.setAuthenticationManager(authenticationManagerBean());
    return customFilter;
  }

即使我把 sessionManagement().sessionFixation().newSession() 但当我删除自定义过滤器时，jesessionid确实会在每次登录和注销时重新设置。
有人知道为什么吗？我想了解。
自定义筛选器具有相同的实现 UsernamePasswordAuthenticationFilter ```
public class CustomFilter extends UsernamePasswordAuthenticationFilter {

public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
if (!request.getMethod().equals("POST")) {
throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
} else {
String username = this.obtainUsername(request);
String password = this.obtainPassword(request);
if (username == null) {
username = "";
}

  if (password == null) {
    password = "";
  }

  username = username.trim();
  UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
  this.setDetails(request, authRequest);
  return this.getAuthenticationManager().authenticate(authRequest);
}

}

}

我根据本指南构建了一个简单的项目：https://spring.io/guides/gs/securing-web/