Direct answer
A session identifier should be renewed at important privilege changes, including authentication, so an earlier unauthenticated identifier cannot simply become the authenticated session.
Establish the anonymous session
In a private browser profile, visit the owned application and record a redacted identifier for the pre-login session. Use a dedicated test account and a separate profile for the comparison. Do not retain live session values in reports.
Reference: OWASP Session Management Cheat Sheet.
Authenticate and compare
Sign in normally and inspect whether the session identifier changes. Attempt the authenticated test action from the separate profile using the pre-login session only if specifically authorized. Confirm whether it remains anonymous or reaches the controlled account.
- Record cookie names and change in value without exposing the value.
- Check privilege elevation and account-switch flows as well as login.
- Use a harmless authenticated endpoint to confirm the session state.
Distinguish rotation from flags
Secure, HttpOnly and SameSite cookie attributes reduce different risks; they do not independently establish session rotation. Review server-side invalidation of the prior identifier as well as the browser's new cookie.
Retest the transition
After the fix, repeat the anonymous-to-authenticated sequence, verify the old identifier does not inherit authentication, and confirm the user remains signed in with the new session. Include intended redirects and any multi-factor step in the test flow.
Assessment limits
Different architectures use multiple cookies and token exchanges. An identifier change alone does not establish complete session security or prove every older token is invalidated.
Frequently asked questions
Is changing the cookie value enough?
Also verify the old identifier cannot act as the authenticated session and that the new one is handled safely by the server.
Do cookie security flags prevent fixation?
They mitigate other cookie risks but do not replace appropriate session renewal and server-side handling at privilege changes.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.