Glossary
Session Fixation
Session fixation works by having an attacker establish a known session identifier and get the victim to authenticate while using it — often through a crafted link — so that once the victim logs in, the attacker's already-known session identifier now represents an authenticated session. The attacker never needs to steal anything after the fact; they simply already hold the identifier that becomes valid the moment the victim logs in.
The standard defense is straightforward once the mechanism is understood: issue a fresh session identifier at the moment of successful authentication, rather than continuing to use whatever identifier was already active beforehand. This breaks the specific step the attack depends on.