---
name: "session-fixation-cookie-guard"
description: "Protect user accounts against session fixation by regenerating session IDs upon login."
metadata:
  author: "OWASP"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "prevent session fixation"
  - "regenerate session id on login"
  - "invalidate session cookie"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Session Fixation Prevention & Regeneration

Prevents session fixation attacks: destroying anonymous pre-login session cookies, generating a fresh cryptographically random session ID upon successful authentication, and binding sessions to client IP/UA fingerprints.

## When to Invoke
Invoke this skill whenever you need to:
- prevent session fixation
- regenerate session id on login
- invalidate session cookie

## Execution SOP & Rules
1. Always call req.session.regenerate() or equivalent framework helper immediately upon authentication.
2. Clear the old session cookie in the client browser during session regeneration.
3. Store session state in secure, encrypted server-side stores (Redis, database).
4. Set maximum idle timeout (e.g. 30 minutes) and absolute session expiration (e.g. 12 hours).

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.