I have a PHP application, where two session IDs are being used.
I will use
bar as example for those session IDs.
foosession ID is being generated at the login page.
barsession ID is being generated after a successful login.
foo session ID is fixed, meaning it's not changing before and after a successful login. The
bar session ID changes after every login and logout. The session is deleted after logging out.
If any of the session IDs (either
bar) is deleted from the browser, the application redirects the user to the login page.
Is this application vulnerable to session fixation or not?