Tag
session-fixation
- May 23, 2024 Session Fixation, Rotation, and Revocation Why authenticating in place hands an attacker a valid session, how rotation must be sequenced to survive concurrent requests, and what revocation can and cannot reach. backend systems
- Feb 8, 2024 Session Fixation and Why Identifiers Must Rotate How an attacker who chooses a session identifier inherits the victim's authenticated session, and which state transitions require a fresh identifier to break the link. security