Session fixation is prevented by…
Options
- Using only long session IDs for every user
- Regenerating the session ID after every login (Correct option)
- Using GET requests for the login endpoint only
- Disabling cookies in the browser of the user
Answer
Regenerating the session ID after login (and privilege changes)
Why
The attacker first gets a valid but anonymous session ID and tricks the victim into using it (e.g. through a crafted link). The victim logs in, and that same session ID now belongs to an authenticated user, which the attacker already knows.
If the server issues a NEW session ID at login, the attacker's planted ID becomes useless.
Remember
New session ID at every login.