Bug ID: JDK-8046298 Configurable to ignore session resumption

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

Other
tbdUnresolved

It would be nice if server side can be configured to ignore session resumption, and always perform full handshaking.

Section 3.6 Session Resumption, NIST Sp 800-52 R1:
------------------------------------------------------------------------------
Typical server implementations are agreeable to resuming a previous session. This is a secure mode of operation, as the master secret is known only to the client and server, and is coupled with the initial client authentication, if client authentication was required. However, if there is a requirement to authenticate each client as it initiates a connection session, the server shall be configured to ignore requests to resume a session, and generate a new session ID, which forces the entire handshake procedure (including client authentication) to proceed.