Sessions
Session fixation
An attack in which the victim is made to sign in with a session identifier the attacker already knows.
What Session fixation means
Session fixation is an attack where the attacker plants a known session identifier in the victim's browser before they sign in. If the application keeps the same identifier after authentication, the attacker can use it to act as the victim. Issuing a new session identifier at login prevents it.
Defined in: OWASP Session Management Cheat Sheet.
How it works
Planting is possible when an application accepts session IDs from URLs, or when a sibling subdomain can set cookies for the parent domain. The attack needs nothing from the victim except an ordinary sign-in.
The OWASP Session Management Cheat Sheet requires regenerating the session ID on any privilege-level change, of which authentication is the most important.
The mistake people actually make
Regenerating on login but not on other privilege changes — switching to an administrator role or completing step-up authentication — which leaves the same window open in a narrower place.
Related terms
Session revocation
Ending an active session so that subsequent requests fail, rather than waiting for a token to expire.
Idle timeout and absolute expiry
Two different session limits: one measured from last activity, one from sign-in.
Absolute session timeout
The maximum lifetime of a session regardless of activity, after which the user must authenticate again.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.