# Session Fixation

> Detects missing session regeneration after login, allowing session fixation attacks.

- Skill: `zakirkun/session-fixation` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/session-fixation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/session-fixation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/session-fixation

---


# Session Fixation

## Overview
Session fixation occurs when an application does not regenerate the session identifier after a successful login. An attacker can set a known session ID before authentication, and after the victim logs in, the attacker reuses the same session ID to gain authenticated access.

## Detection Strategy
Look for authentication flows (login functions) that do not call session regeneration functions before or after setting the authenticated user context.

Key patterns:
- Login handlers that set session user data without regenerating the session token
- Use of `session_start()` without a subsequent `session_regenerate_id(true)` in PHP
- Express.js `req.session.regenerate()` not called after login
- Django `cycle_key()` or `flush()` not called after `authenticate()`

## Remediation
Always regenerate the session ID after a successful authentication event.

**Vulnerable (PHP):**
```php
session_start();
if ($valid_login) {
    $_SESSION['user'] = $username; // no session_regenerate_id!
}
```

**Safe (PHP):**
```php
session_start();
if ($valid_login) {
    session_regenerate_id(true);
    $_SESSION['user'] = $username;
}
```

**Safe (Express.js):**
```js
req.session.regenerate((err) => {
    req.session.user = user;
    res.redirect('/dashboard');
});
```