Session fixation is a security attack where an attacker sets a user's session identifier, aiming to hijack their session and gain unauthorized access.
Example
In 2011, security researcher Rishi Narang discovered a session fixation vulnerability on LinkedIn. The vulnerability allowed an attacker to set a user's session ID to a known value, potentially leading to session hijacking. The issue stemmed from LinkedIn's handling of session identifiers during the login process. The vulnerability was patched.
