Glossary term
What is session fixation? Meaning for developers
In Backend in Depth
An attacker sets a known session ID before the user logs in. Stop it by creating a new ID at login.
Learn it properly · Backend in DepthLesson 6: Authentication and Authorization on the ServerPassword hashing, session stores, checking JWTs properly, role-based vs attribute-based access control, and checking ownership on every resource.In Security for Developers
An attack where the attacker plants a known session ID in the victim's browser and uses it after the victim logs in. Fix it by making a new ID at login.
Learn it properly · Security for DevelopersLesson 3: Passwords and Login: Hashing, Sessions, MFA and Rate LimitsWhy you never store passwords, hashing with a salt (scrypt and Argon2), safe sessions and JWT mistakes, password reset flows, MFA, and stopping brute force.