I have a PHP application, where two session IDs are being used.
I will use foo
and bar
as example for those session IDs.
- The
foo
session ID is being generated at the login page. - The
bar
session ID is being generated after a successful login.
The foo
session ID is fixed, meaning it's not changing before and after a successful login. The bar
session ID changes after every login and logout. The session is deleted after logging out.
If any of the session IDs (either foo
or bar
) is deleted from the browser, the application redirects the user to the login page.
Is this application vulnerable to session fixation or not?