Session ID Rotation Closes the Pre-Authentication Session Gap
Session ID Rotation Closes the Pre-Authentication Session Gap A web application can assign a session before a user signs in. That anonymous session may hold a CSRF token, locale, shopping state, or other temporary data. Authentication changes the authority attached to the session: the server now treats requests carrying that session as belonging to an identified account. If the application keeps the same session identifier across that transition, a value established before authentication can become the handle for an authenticated session. Session fixation attacks target that continuity. The defensive boundary is the authentication event itself: preserve only the state that should survive, issue a fresh unpredictable identifier, and retire the old identifier.