Archivesecurity
Session Fixation: Rotate the ID at Login
If an attacker can plant a session identifier, the victim authenticates the attacker into their own account.
- Published
- Reading time
- 1 min read
Session fixation works like this: the attacker obtains a valid session ID and tricks the victim into using it (via a URL parameter, a subdomain cookie, or a shared device). When the victim logs in, the server upgrades that same session to authenticated — and the attacker now holds an authenticated session.
The fix
Always issue a new session ID on privilege change: login, logout, role change, password reset. Invalidate the old one. Do the same after MFA.
Related hygiene
- Cookies:
HttpOnly,Secure,SameSite=LaxorStrict, scoped path and domain. - Do not accept session IDs from URLs.
- Bound sessions to context (IP or user agent) carefully — it breaks mobile users and is not a strong control.
- Rotate on a schedule and support "log out everywhere".
Takeaway: authentication must create a fresh session, not elevate an existing one. Rotation at privilege boundaries is the whole defense.