Session Fixation / Weak Session
High · Session · CWE-384
Description
Predictable or fixable session IDs; missing rotation on login.
Root cause
Poor session lifecycle.
Impact
Account takeover.
Detection
Session ID entropy/rotation tests.
Mitigation
Regenerate session on login; Secure/HttpOnly/SameSite.
Secure coding
Use framework session managers.
Safe lab example
Auth labs
Practise related skills in Labs or deepen on Academy library.