search

riverrun / phauxth

Not actively maintained - Authentication library for Phoenix, and other Plug-based, web applications
409 stars 21 forks source link

Renew session after login to avoid session fixation attacks #23

Closed fabrik42 closed 7 years ago

fabrik42 commented 7 years ago

In the official Phoenix guides it is recommended to generate a new session id after a successful login, in order to prevent session fixation attacks.

See https://hexdocs.pm/phoenix/contexts.html#adding-account-functions

riverrun commented 7 years ago

Good catch!