What is session fixation and how do you prevent it?
PICTURE THIS: STACK VS QUEUE
Simple meaning
Session fixation tricks a user into authenticating inside an attacker-known session id.
WHY — Auth instead of guessing?
Why interviewers care about Auth:
who only read docs from people who shipped.
and tied to Full Stack work.
Name the idea, why it exists, then one short example.
End with when you use it and one common pitfall.
STEPS — What happens step by step?
Before you speak the answer, walk the interviewer through these steps:
- 1Session fixation tricks a
user into authenticating inside an attacker-known session id.
- 2After login you must
issue a fresh session id and expire the old one.
- 3Cookie flags alone do
not fix this if you reuse the pre-login id.
- 4Give an example
One tiny concrete case you can say aloud.
- 5Common mistake
What juniors usually get wrong.
- 6Close
When you pick this over the alternative.
EXAMPLE — See it in action
Here's a short line you can speak, broken into clear beats:
Note: Adapt this scaffold to your own project — keep it under 60–90 seconds.
Key takeaway
Session fixation tricks a user into authenticating inside an attacker-known session id. After login you must issue a fresh session id and expire the old one.