Session Fixation
: An attack where an adversary sets or predicts a user’s session identifier before authentication, then hijacks the session after the user logs in with the attacker-controlled session ID. Unlike session hijacking (stealing an existing session), session fixation plants a known session ID in advance.
Why It Matters for AI-Coded Apps
AI-generated authentication code often fails to regenerate session IDs after login. The LLM creates a working login flow but does not rotate the session token upon successful authentication, leaving the pre-authentication session ID valid for the authenticated session.
Real-World Example
An attacker sends a link containing https://app.com/login?sessionid=abc123. The victim clicks the link, logs in, and the server authenticates the session abc123. The attacker, who knows this session ID, now has authenticated access to the victim’s account.
How to Detect and Prevent It
Always regenerate the session ID immediately after successful authentication. Most frameworks provide this: req.session.regenerate() in Express, request.session.cycle_id() in Django. Reject session IDs from URL parameters. Set session cookies with HttpOnly, Secure, and SameSite flags.
Frequently Asked Questions
How is session fixation different from session hijacking?
Session fixation plants a known session ID before authentication. Session hijacking steals an existing valid session ID after authentication, typically through XSS, network sniffing, or side-channel attacks. Fixation is proactive (attacker sets the ID); hijacking is reactive (attacker captures the ID).
Do modern frameworks prevent session fixation automatically?
Many modern frameworks regenerate session IDs on login by default (Django, Rails). However, Express/Node.js, FastAPI, and many vibe-coding stacks require explicit session regeneration. Always verify your framework’s behavior rather than assuming protection.
Can JWT-based auth have session fixation?
Traditional session fixation does not apply to stateless JWTs since tokens are generated server-side after authentication. However, if refresh tokens are reusable or predictable, a similar attack pattern can emerge where an attacker plants a known refresh token.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval