What are key practices to prevent session fixation attacks? (Choose two)

The correct answer is A. Regenerating session IDs after user authentication C. Implementing session expiration policies. Regenerating session IDs after authentication (A) directly defeats session fixation by ensuring that any session ID an attacker may have planted before login becomes invalid the moment the user authenticates - the new ID is unknown to the attacker. Session expiration policies…

Question

Options

ARegenerating session IDs after user authentication
BForcing users to use fixed session IDs
CImplementing session expiration policies
DAllowing session reuse without revalidation

How the community answered

(31 responses)

A
81% (25)
B
13% (4)
D
6% (2)

Explanation

Regenerating session IDs after authentication (A) directly defeats session fixation by ensuring that any session ID an attacker may have planted before login becomes invalid the moment the user authenticates - the new ID is unknown to the attacker. Session expiration policies (C) limit the window of opportunity for an attacker to exploit a hijacked or fixated session, making stolen IDs worthless after a short time.

Option B is wrong because forcing fixed session IDs is the definition of session fixation - it's the attack vector, not a defense. Option D is wrong because allowing session reuse without revalidation lets attackers indefinitely exploit a captured session ID, which is precisely what session management controls are designed to prevent.

Memory tip: Think "R.E.S.E.T." - after login, REgenerate the SEssion and set a Timeout. Both controls ensure an attacker's pre-obtained session ID can never stay useful.

Community Discussion

No community discussion yet for this question.

Full GWAPT Practice