security auth_error ai_generated true

Session fixation: session ID not regenerated after login

ID: security/session-fixation

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Session ID not rotated on authentication, allowing fixation attack.

generic

Workarounds

  1. 92% success Regenerate session ID after successful authentication 
    request.session.regenerate()
  2. 90% success Set session cookie as HttpOnly, Secure, SameSite=Strict

Dead Ends

Common approaches that don't work:

  1. Destroy session on every page load 82% fail

    Terrible UX, loses all session data

  2. Use long session IDs to prevent guessing 78% fail

    Doesnt prevent fixation