Session Fixation and Session Token Exposure

What Is Broken and Why

Session fixation occurs when an application authenticates a user but retains the pre-authentication session token rather than issuing a fresh one. An attacker who plants a known token (via URL parameter, XSS, or network manipulation) can then authenticate as the victim by using that same token once the victim logs in. Session token exposure extends the attack surface by allowing tokens to be harvested from HTTP traffic, proxy logs, browser history, and caches when tokens are transmitted without encryption or appear in GET request URLs. Predictable session tokens that can be forged complete the trifecta of session management failures.

Key Signals