The attacker picked your session ID before you logged in

transcript

You log in with a strong password. The attacker gets in anyway. Because they chose your session ID. Before you even logged in.

Here's the trick. The attacker gets you to use a session ID they already know. Then they wait. You log in, completely normally. If the server keeps that same ID, it's now a logged-in session. And the attacker has had it all along. That's session fixation.

Encrypt the session data? Doesn't matter. They still know the ID. A shorter TTL? Same problem. They know the ID. The fix: at login, delete any old session. And issue a brand new ID. The planted one never gets logged in.

And make every ID unguessable. 256 bits of randomness. Never sess 1, sess 2. Never accept a session ID from the client before authentication. And lock the cookie down. HttpOnly, Secure, SameSite Lax.

A session ID is effectively a key to someone's account. So never let a login inherit an old one. New login. New ID.

Full breakdown in the lecture.