Depending on the case (not for mail requests with csrf protection in the form, for example), you can also use migration:
$request->getSession()->migrate();
According to the docs: "Transferring the current session to a new session identifier while retaining all session attributes."
source share