Glossary

Session fixation

An attacker makes the victim authenticate with a session identifier the attacker already knows, then uses that session (CWE-384). Issue a new session identifier at login and at every change of privilege, and reject identifiers the server did not issue.

Fix it in your stack: Session fixation and session cookies fix cards (6 stacks) · CWE-384 page
Defined in: MITRE CWE-384
Identifiers: CWE-384: Session fixation

Covered in

Guide

Session management: cookies, timeouts, rotation and revocation

Model authentication as transitions in server authority, set session cookies and timeouts to current NIST and OWASP values, and verify fixation prevention, expiry, reauthentication, revocation and stolen-cookie defenses.