Is my session schema vulnerable to session fixation?

Question

I have a PHP application, where two session IDs are being used.

I will use foo and bar as example for those session IDs.

• The foo session ID is being generated at the login page.
• The bar session ID is being generated after a successful login.

The foo session ID is fixed, meaning it's not changing before and after a successful login. The bar session ID changes after every login and logout. The session is deleted after logging out.

If any of the session IDs (either foo or bar) is deleted from the browser, the application redirects the user to the login page.

Is this application vulnerable to session fixation or not?

Answer 1

If your CMS is creating the session, don't create another one. If you use session_start() somewhere on your custom code, you will use the same session your CMS created.

Don't create another another wheel to replace the professional wheel you already have.