Session fixation

Meaning

Session fixation is an attack in which the attacker sets a known session identifier in the victim's browser before the victim logs in, then reuses it afterwards. The defence is to issue a fresh identifier at login and after privilege changes; MDN advises regenerating and resending session cookies whenever a user authenticates. Identifiers should come from a cryptographically secure random generator, never from a username or a counter. Rotating the identifier periodically limits the value of any stolen copy. See also: Session cookie, HttpOnly, Cookie prefix, the guide "Sessions vs Tokens: Where Cookies Fit".