I don't like the class SessionIdChangedEvent either as that can happen for any number of reasons. I don't want to imply that it will be linked to the HttpServletRequest#changeSessionId() method. Can we stick with SessionFixationProtectionEvent for a non-migration event and a SessionMigrationProtectionEvent (extends SessionFixationProtectionEvent) for a migration event?

I'd really like to nail down an event that captures only instances we intend to fire the event on and in which we guarantee it will happen.