Glossary · Phase 8 · APIs
Session fixation
An attack where someone plants a session in your browser before you log in, then shares your signed-in session. Starting a fresh session at login stops it.
Try it now
Most account bugs are small choices like these. Each safe choice costs a line or two.
Learn it properly
Accounts and logins · Password hashing with bcrypt, sessions, pages that need a login, and safe logout. About 45 minutes.
Other terms from the same lesson
- open redirect: A page that sends visitors on to any address named in its link, which attackers use to make links to look-alike sites seem trustworthy.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.