Session Fixation

Session fixation works when the session identifier issued before login is still valid after login. The attacker plants a known session id on the victim, the victim authenticates, and the now-privileged session is one the attacker already knows.

How it works

1. The attacker obtains a valid pre-auth session id (often just by visiting the site) or sets one on the victim via a crafted link, an Set-Cookie injection, or a permissive cookie scope.
2. The victim logs in. Because the server does not rotate the session id at the privilege boundary, the id stays the same.
3. The attacker uses the fixed id — now bound to the victim's authenticated session.

How to test

Note the session id before login, authenticate, and check whether it changed. If the pre-auth id remains valid afterward, the app is vulnerable. Also test whether the app accepts a session id supplied by the client.

Impact

Full session hijacking and account takeover without ever stealing the victim's credentials.

Defenses

• Regenerate the session id on every privilege change (login, step-up, role change).
• Only accept server-generated session ids; set HttpOnly, Secure, SameSite.