Page 19 – Should V37 and V38 prevent the same issue?

[defern]

Page 19 – Should V37 and V38 prevent the same issue?

V37 Verify that the session id is changed on login to prevent session fixation.
V38 Verify that the session id is changed upon re-authentication.

Should we add “to prevent session fixation.” To v38?

[vanderaj]

Good pickup. We changed 3.7 to be

Verify that all successful authentication and re-authentication generates a new session and session id.

3.8 has been removed.