Web Security · Junior · Question 52 of 75
Why should a new session ID be issued right after login?
- ✓Correct answer: To prevent session fixation, where an attacker plants a known session ID before the victim logs in
- 2Because session IDs expire every time a page loads
- 3So the browser can cache the login page
Explanation
If the ID stays the same before and after login, an attacker who set it in advance would share the victim's logged-in session.