security session_management ai_generated true

Session hijacking possible because session ID is not regenerated after login

ID: security/session-fixation-no-regeneration

Also available as: JSON · Markdown
90%Fix Rate
92%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

If the session ID remains the same after login, an attacker who knows the pre-auth session ID (e.g., via URL, XSS, or shared computer) automatically gains authenticated access. Most web frameworks do NOT auto-regenerate session IDs on login.

generic

Workarounds

  1. 95% success Explicitly regenerate session ID after successful authentication 
    Flask: session.regenerate(); Django: request.session.cycle_key(); Express: req.session.regenerate(cb)
  2. 90% success Invalidate old session and create entirely new one on login 
    Destroy existing session completely, create new session with new ID, then populate with user data
  3. 85% success Set session cookies with Secure, HttpOnly, SameSite=Lax attributes 
    response.set_cookie('session', value, httponly=True, secure=True, samesite='Lax')

Dead Ends

Common approaches that don't work:

  1. Assume the web framework regenerates session ID on login automatically 88% fail

    Most frameworks (Express, Flask, Django, Spring) do NOT auto-regenerate session IDs on authentication state change. You must do it explicitly.

  2. Create a new session only when the user first visits 82% fail

    The issue isn't session creation timing but that the same session ID survives the authentication boundary. Pre-auth and post-auth must have different IDs.