Study. uk . com
  1. Home
  2. All questions
  3. Question 285

CompTIA Security+ study material · question 285 of 611

At which moment must an application regenerate the session identifier to prevent session fixation?

  1. Immediately after a successful login
  2. When the session is first created
  3. When the session times out
  4. On every request
Show the answer

Answer: A. Immediately after a successful login

Regeneration at any privilege change, above all at login, invalidates an identifier the attacker planted beforehand.

Source: OWASP Session Management Cheat Sheet (OWASP) — OWASP Session Management Cheat Sheet › Renew the Session ID After Any Privilege Level Change

Challenge yourself on this topic → Study as cards