session-fixation-anti-pattern

name	session-fixation-anti-pattern
description	Security anti-pattern for session fixation vulnerabilities (CWE-384). Use when generating or reviewing code that handles user sessions, login flows, or authentication state changes. Detects failure to regenerate session IDs after authentication.

Session Fixation Anti-Pattern

Severity: High

Summary

Attackers fix a user's session ID before login. The attacker obtains a valid session ID, tricks the victim into using it, and when authentication fails to regenerate the session ID, hijacks the victim's authenticated session.

The Anti-Pattern

The anti-pattern is reusing the same session ID before and after authentication.

BAD Code Example

# VULNERABLE: Session ID not regenerated after login.
from flask import Flask, session, redirect, url_for, request

app = Flask(__name__)
app.secret_key = 'your_secret_key' # Insecure in production

@app.route('/')
def index():
    if 'username' in session:
        return f'Hello {session["username"]}! <a href="/logout">Logout</a>'
    return 'Welcome, please <a href="/login">Login</a>'

@app.route('/login', methods=[, ])
 ():
     request.method == :
        username = request.form[]
        password = request.form[]
         check_credentials(username, password):
            
            
            session[] = username
             redirect(url_for())