HttpSessionManager

Default SessionManager backed by the servlet HTTP session.

Stores the caller's SessionDetails as a session attribute under attributeKey. On create, ensures a session exists and (when rotateSessionIdOnCreate is true) rotates the session id via HttpServletRequest.changeSessionId() to defend against session fixation. On invalidate, clears the attribute and (when invalidateSessionOnDestroy is true) calls HttpSession.invalidate().

validate never creates a session — it only reads the current session, preserving the "no credentials → anonymous" contract of the extension.

The stored SessionDetails.identity must be Serializable so it can travel with the session when the container uses a distributed session store. create rejects non-serializable identities with IllegalArgumentException — surface the failure at create time rather than at replication time. Prefer enum io.javalin.security.RouteRoles (enums are serializable) when sessions may be replicated.