search

toraritte / knowledge-gaps

All the stuff I don't know, but would like to (or should)
0 stars 0 forks source link

Plug.Conn.configure_session(conn, renew: true) - What does it do exactly? #8

Open toraritte opened 6 years ago

toraritte commented 6 years ago

From the documentation:

Configures the session.

Options

  • :renew - generates a new session id for the cookie
  • :drop - drops the session, a session cookie will not be included in the response
  • :ignore - ignores all changes made to the session in this request cycle

Does this mean that a new session_id is generated on each request? Or how else would it be able to prevent fixation attacks?