How can I prevent session fixation attacks on my web application?
Asked on Oct 11, 2025
Answer
To prevent session fixation attacks, regenerate the session ID after a user logs in to ensure that the session ID is not predictable or reused.
<!-- BEGIN COPY / PASTE -->
// Example in PHP
session_start();
// Regenerate session ID to prevent fixation
session_regenerate_id(true);
// Continue with user authentication
$_SESSION['user_id'] = $userId;
<!-- END COPY / PASTE -->Additional Comment:
- Always regenerate the session ID after a successful login to prevent attackers from using a fixed session ID.
- Ensure that session cookies have the 'HttpOnly' and 'Secure' flags set to protect against XSS and eavesdropping.
- Implement a short session timeout to limit the duration of any potential session hijacking.
✅ Answered with Security best practices.
Recommended Links: