Session Fixation

Session fixation is a web attack in which the attacker gets a victim to use a session identifier the attacker already knows. If the application keeps that same identifier after login, the attacker's copy of the ID becomes an authenticated session.

Why it matters

Unlike session hijacking, the attacker does not need to steal an ID after the fact. They plant it: through a URL parameter such as ?PHPSESSID=abc, a cookie set from a sibling subdomain or through injected markup. After the victim signs in, the attacker presents the same ID and is logged in as the victim.

The core defense is simple and should be built into every login flow: issue a new session ID when privilege changes. Accepting session IDs only from cookies, not URLs, and using cookie prefixes also help.

Example

In PHP:

if (password_verify($input, $hash)) {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $user['id'];
}

The true argument deletes the old session data. Frameworks such as Django and Rails rotate IDs on login by default, but custom code often does not.

Common mistakes

• Regenerating the ID only at the start of a session, not after login or privilege change.
• Accepting session IDs in query strings.
• Leaving the old session valid after logout.

Related

• Session hijacking
• Session
• Cookie prefixes
• HttpOnly cookie

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.