thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Session Fixation

An attack in which the attacker sets a victim's session ID before login and then uses it after the victim authenticates.

Definition

It works when an application accepts externally supplied session IDs or does not issue a new ID on authentication. The fix is regenerating the session identifier upon login and privilege change and refusing IDs not issued by the server.

Example

An attacker sends a link containing a known session ID; after the victim logs in, the attacker uses the same ID.

Exam tip

Fix: regenerate the session ID after successful authentication.

Related terms