Session Fixation: How to Test and Prove Account Takeover
Session fixation lets an attacker force a victim to use a session identifier the attacker already knows. After the victim logs in, the same ID becomes an authenticated session — and the attacker rides it.
It is classic but still appears when apps accept client-supplied session IDs or fail to rotate the session on login.
How the attack flows
- Attacker obtains or sets a session ID (cookie, URL param, or hidden field).
- Victim authenticates while that ID is still active.
- Server upgrades the same ID to a logged-in session.
- Attacker presents the ID and inherits the victim's privileges.
Testing method (two browsers, your accounts)
- Browser A: start a login flow and capture the pre-auth session cookie.
- Browser B: import that cookie (or open the fixation URL if the app puts the ID in the query string).
- Browser B: log in as your test user.
- Browser A: reload an authenticated page using the original cookie.
If Browser A is now logged in as the user from Browser B without knowing the password, you have fixation.
Places it hides
- Session IDs accepted from URL parameters
- Login that does not call session regenerate / rotate
- “Remember me” or SSO callbacks that reuse anonymous sessions
- Mobile APIs that let clients choose
X-Session-Id
Strong vs weak reports
Strong: clear pre-auth ID → post-login reuse → authenticated action as the victim test account.
Weak: session cookie exists before login (normal) without proving it survives authentication unchanged.
Remediations to suggest
- Issue a fresh session ID on every successful authentication.
- Invalidate the anonymous session at login.
- Never accept session IDs from URL query strings.
- Use
Secure,HttpOnly, and appropriateSameSitecookie flags.
Defensive checklist
- Rotate session identifiers on privilege change (login, MFA, password change).
- Reject client-chosen session tokens.
- Bind sessions to user agent / network signals carefully (avoid locking out legitimate users).
- Add tests that assert the cookie value changes across login.
Session fixation is an identity bug. Prove the ID did not rotate — that single fact is the report.
Original Bugflare guide informed by OWASP session fixation guidance.