Best Practice for Session ID Regeneration to Prevent Session Fixation Attacks

[kaiserbh]

Hello,

So I'm interested in implementing security best practices, specifically against session fixation attacks. In other libraries (axum-session), there is often a method to regenerate the session ID upon successful user login for example session.regenerate(). However, I couldn't find a straightforward way to achieve this with tower-session.

I see that there are methods like session.clear(), session.delete(), and session.flush(). Could you please clarify which of these methods, if any, would be most effective for preventing session fixation attacks (read more on session fixation) by regenerating the session ID?

Regards,
KB

[maxcountryman]

You're looking for cycle_id, this will regenerate the session ID.

[kaiserbh]

Thank you for the quick and insightful reply! cycle_id is exactly what I was looking for. Much appreciated.