Rotate the session ID after login

session-fixation

If the session ID survives login, an ID planted beforehand keeps working afterwards. Issue a fresh session ID every time someone authenticates.

Why this matters

Your site doesn't change the session ID after login. Exploiting this requires XSS or subdomain cookie planting to deliver the fixed session ID — not independently exploitable.

Your stack

Express

1 Regenerate the session ID after successful login

javascript

app.post('/login', (req, res) => {
  // ... authenticate user
  req.session.regenerate((err) => {
    if (err) return next(err);
    req.session.userId = user.id;
    res.redirect('/dashboard');
  });
});

Django

1 Django regenerates session keys on login by default
2 Ensure you use django.contrib.auth.login()

python

from django.contrib.auth import login

def login_view(request):
    # ... authenticate user
    login(request, user)  # auto-regenerates session

Laravel

1 Laravel regenerates the session on login by default
2 Ensure you use Auth::attempt() or Auth::login()

php

// This automatically regenerates the session
if (Auth::attempt($credentials)) {
    $request->session()->regenerate();
    return redirect('/dashboard');
}

Rails

1 Rails regenerates sessions by default with Devise
2 If using custom auth, call reset_session

ruby

def create
  # ... authenticate user
  reset_session  # regenerate session ID
  session[:user_id] = user.id
end

Spring Boot

1 Spring Security regenerates sessions by default
2 Ensure sessionManagement is configured

java

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.sessionManagement(session -> session
        .sessionFixation().changeSessionId()
    );
    return http.build();
}

Does your app still have this?

Scan your domain