Someone stepped up to me calling me out on not assigning a new session-ID on successfull login.
Basically i was told: The fact that i use the same cookie (with the same SID) in the login-page as well as the remaining authorized session makes my website vulnerable to session-fixation.
First of all, i don't even understand the term in this case: This has nothing to do with session-fixation, does it? My SIDs are sent back and forth using HttpOnly and Secure HTML-Cookies. Meaning fixation by calling an URL with a certain SID wont even happen, because my website doesn't use URL-SIDs.
I could not think of any other way a session could be set by a potential hacker to his desires. The only way he could would require him to execute a JS from my domain and that would require the domain to be XSS-vulnerable, right?
And then again i also always bind a request-IP into a session, meaning once a different request-IP from the one already bound to the session is trying to use that session i will invalidate this session and kick the user out.
Am i being ignorant towards a certain circumstance here or his my website not vulnerable to session-fixation as claimed? I searched through quite a good amount of examples regarding session-fixation and i feel like i have no need to take any actions here?