topic
Verified 2026-09-18Session Fixation
Session fixation occurs when an attacker makes a victim use a session identifier the attacker already knows.
Regenerate the session identifier after login or privilege changes, set appropriate cookie scope, and invalidate old sessions when the account state changes.
httpcookiesauthsecurity
Reference (http)
Set-Cookie: __Host-session=<new-id>; Secure; HttpOnly; SameSite=Lax; Path=/
Regenerate the session identifier after login or privilege changes, set appropriate cookie scope, and invalidate old sessions when the account state changes.
Common mistakes
- Keeping the pre-login session identifier after authentication.