Session fixation: fixing the ID before login

A session is identified by an ID in the cookie. In fixation the attacker knows the ID before the victim authenticates, and imposes it.

The flow

The attacker gets a valid ID from the server, forces it into the victim's browser (link with ?PHPSESSID=..., or a cookie via XSS). The victim logs in on that ID. If the server reuses the same ID after login, the attacker — who knows it — is now inside the authenticated session.

Defence

// at login, always:
session_regenerate_id(true);

Regenerate the ID on every privilege change (login, elevation). HttpOnly, Secure, SameSite cookies. Do not accept the session ID from the URL. Server-side expiry and invalidation on logout.