Session Fixation

This attack occurs when the web application does not generate a new session ID after the user logs in. In this case, the application gives users the same IDs before and after authentication. It can also happen when the application generates static or easily guessable session IDs.