Session fixation and session ID renewal¶

Session fixation can occur when an identifier known before authentication remains the identifier for the authenticated session. An attacker who can make a victim use a known identifier may then reuse it. The exact exposure depends on how sessions are issued, accepted and transported.

Renew the session at authentication¶

This example uses Express with express-session. It belongs inside a login handler only after credentials, required MFA and login-CSRF checks have succeeded. verifiedUser comes from that completed authentication flow, never directly from request data.

Unsafe pattern: promote the existing session without renewal.

req.session.userId = verifiedUser.id;
req.session.save((err) => {
  if (err) return next(err);
  res.redirect(303, '/account');
});

Safer: regenerate, populate the new session, and save before redirecting.

req.session.regenerate((err) => {
  if (err) return next(err);
  req.session.userId = verifiedUser.id;
  req.session.save((err) => {
    if (err) return next(err);
    res.redirect(303, '/account');
  });
});

The new session identifier separates the authenticated state from the earlier session. Persisting before the redirect avoids a follow-up request racing the store write. The express-session reference documents regeneration and saving.

Preserve only explicitly approved pre-login state, such as a validated local return path. Do not copy the entire old session into the new one. Review renewal on other privilege changes and destroy the authenticated session on logout. Use a production-appropriate session store and cookie settings including Secure, HttpOnly and a SameSite policy suitable for the application.

Check the transition¶

In a disposable application, obtain an anonymous session cookie, complete a fictional user's login and capture the new cookie. Assert the identifiers differ. A request carrying only the old identifier must remain unauthenticated; the new one should access only that user's permitted records. Simulate regeneration and store failures and ensure the handler does not report a successful login redirect.

OWASP's session-management guidance covers identifier renewal and related controls. Continue with cookie flags, CSRF and broken object authorization. Renewal addresses fixation; it does not replace authentication, authorization or protection against a stolen current cookie.