Beyond Secure Flags: CSRF and Session Fixation Risks Every Developer Should Know

A technical explainer outlines two often-overlooked session security threats: Cross-Site Request Forgery (CSRF) and session fixation. CSRF exploits the browser's automatic cookie-sending behaviour, allowing attackers to trigger authenticated requests without ever stealing a session token; CSRF tokens paired with SameSite attributes are recommended defences. Session fixation takes the opposite approach, where an attacker plants a known session ID before a user logs in and retains access if the server does not replace that ID upon authentication. The recommended fix is to regenerate the session identifier whenever authentication state changes, such as at login or privilege escalation. Together, these vulnerabilities highlight that cookie security attributes alone are insufficient to protect the full session lifecycle.