qeeqbox/session-fixation

This project is a deliberately vulnerable web app that demonstrates a security flaw called "session fixation." It exists to teach developers, security learners, and product teams how attackers can hijack user accounts without ever needing a password. Session fixation works because of a simple mistake: when someone logs in, the app fails to give them a fresh session identifier. A session identifier is a small token your browser uses to prove who you are after you've authenticated. In this attack, a bad actor obtains a valid but unauthenticated token, tricks a victim into using it, and then waits for the victim to log in. Since the app never issues a new token after login, the attacker can reuse the known identifier to step into the victim's authenticated session and take over the account. The repository lets you run a small Python web server that intentionally has this flaw. You clone the code, start the app, and log in as a test user named John. By following the included walkthrough, you can open a separate browser tab, pass John's session identifier through the URL, log in as a different user named Jane, and then refresh John's tab to see Jane's session appear. It's a hands-on way to watch the attack happen step by step. The README also explains how to fix the underlying problem. The primary defense is regenerating session identifiers immediately after a successful login so old tokens become useless. Other recommendations include using secure cookie settings, enforcing HTTPS, monitoring for suspicious session activity, and expiring inactive sessions. The project's value is in making an abstract security concept concrete and visible.