Cybersecurity glossary
What is Session Fixation?
Learn what session fixation is, how attackers force victims to use a known session ID, how it differs from session hijacking, and how to prevent fixation with session regeneration.
Definition
Session fixation is an attack in which an adversary establishes or obtains a known session identifier and tricks a victim into authenticating under that same session ID, allowing the attacker to reuse the authenticated session afterward.
Why session fixation works
Web apps track logged-in users with session identifiers. If that identifier is predictable—or worse, attacker-chosen—and survives the login transition, the attacker who planted it inherits the authenticated session.
Session fixation is an old but still relevant authentication-lifecycle flaw. Modern frameworks often regenerate sessions on login; custom systems sometimes forget.
How a fixation attack unfolds
Attacker obtains a session ID
They visit the site or forge an ID the application will accept.
Victim is coerced onto that ID
A malicious link, XSS, or other vector sets the victim’s session cookie/parameter.
Victim authenticates
Login succeeds, but the session ID does not change.
Attacker reuses the same ID
They present the known identifier and operate as the authenticated user.
Fixation vs related session attacks
| Attack | Timing | Goal |
|---|---|---|
| Session fixation | Before / during login | Reuse a planted session after auth |
| Session hijacking | After auth | Steal or guess an existing session |
| Session prediction | Anytime | Guess valid session IDs |
Defenses that actually work
Regenerate on login
Always issue a fresh session ID after successful authentication and role elevation.
Server-controlled IDs only
Reject client-supplied session identifiers; generate cryptographically strong IDs server-side.
Cookie attributes
Use Secure, HttpOnly, and appropriate SameSite settings for session cookies.
No URL sessions
Keep session IDs out of query strings and path segments.
- Regenerate session identifiers on login and privilege changes.
- Do not accept session IDs from query parameters or forms.
- Use framework session APIs that regenerate securely by default.
- Invalidate old session records when rotating IDs.
- Bind sessions to additional signals where appropriate (careful with IP binding).
- Expire idle and absolute sessions on the server.
- Test login flows for ID continuity before and after authentication.
- Educate developers that 'session exists' is not the same as 'session is safe'.
The practical takeaway
Session fixation lets attackers plant a known session ID, wait for the victim to authenticate, then reuse that session. The core fix is regenerating the session ID at authentication boundaries.
If your login keeps the pre-auth session cookie unchanged, treat that as a defect until proven otherwise.
Related security terms
Session Hijacking
Stealing an existing session rather than planting one beforehand.
Session Management
Broader practices for creating, rotating, and ending sessions safely.
Broken Authentication
Category of flaws that includes weak session handling.
Cross-Site Scripting (XSS)
Can deliver fixation payloads or steal session tokens.
Frequently asked questions
What is session fixation in simple terms?
The attacker makes you log in using a session ID they already know. After you authenticate, they use that same ID to act as you.
How does session fixation differ from session hijacking?
Fixation plants a known ID before login. Hijacking steals or guesses an ID after the victim already has a valid session.
How do attackers set the victim’s session ID?
Via crafted links with session parameters, XSS that sets cookies, meta tags, or vulnerable apps that accept session IDs from URLs or forms.
How do you prevent session fixation?
Issue a new session ID on privilege changes—especially after successful login—and avoid accepting attacker-chosen session identifiers.
Should session IDs appear in URLs?
No. URL session IDs leak via Referer, logs, and history and make fixation and theft easier. Prefer secure cookies.
Does HTTPS alone stop session fixation?
No. Fixation is about identifier lifecycle, not transport encryption. HTTPS still matters against network theft.
References
Explore authoritative guidance and frameworks related to session fixation.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.