I'm not too convinced on the naming conventions of the two classes being published. The reason is that there are many reasons a SessionIdChangedEvent might need to be fired which are not related to session fixation. I think perhaps a better approach is creating a single SessionFixationProtectionEvent which contains a boolean to indicate if the parameters were migrated. This ensures the event matches closely with why it is being fired.