We have a security finding where we need to Invalidate all existing session tokens on any change of authentication state. Is there any way we can achieve this?

We Identified that session cookies are not being updated when the user transitions between different levels of authentication.

We are using Tomcat server 7.0.64