https://nalar.dev/tags/sessions/ Recent content in Sessions on Nalar Hugo en-us Tue, 01 Sep 2026 00:00:00 +0700 https://nalar.dev/prevent-session-fixation-web-authentication/ Tue, 01 Sep 2026 00:00:00 +0700 https://nalar.dev/prevent-session-fixation-web-authentication/ <p>Session fixation occurs when an attacker can cause a victim to authenticate while using a session identifier the attacker already knows. If the application keeps that identifier after login, the attacker may reuse it to access the newly authenticated session.</p> <p>The core defense is to change the session identifier whenever privilege changes.</p> <h2 id="rotate-at-authentication-boundaries">Rotate at authentication boundaries</h2> <p>After credentials, passkeys, or another authentication factor succeeds, create a fresh unpredictable session identifier and retire the pre-authentication identifier. Apply the same principle after privilege elevation, impersonation boundaries, or other security-sensitive identity changes.</p>