Interview question

What is session fixation and how do you prevent it? Session fixation क्या है?

Answer

Session fixation is when an attacker forces a user to use a known session ID. Prevent it by regenerating the session ID on login.

if (validate_credentials($username, $password)) {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $userId;
}

Session fixation एक attack है। Login पर session ID regenerate करके इससे बचें।

if (validate_credentials($username, $password)) {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $userId;
}

Was this answer clear?

Related questions