What is 'session fixation' and what must the server do to prevent it at authentication time?

• A.In this attack, an attacker steals the victim's session ID after login (via XSS or a network capture), then reuses it from another host; the server must bind the session to the client IP at authentication, rejecting requests from other addresses, a binding that fails for users behind rotating proxies
• B.Fixation means an attacker guesses the next session ID from a predictable counter (like a sequential number), then uses it before the victim logs in; the server must sign the session ID with an HMAC at authentication, rejecting any unsigned value from the client on each later request
• C.The term describes an attacker who forces the victim to log in on a fake page (via a phishing link), then captures the typed password; the server must display the last login time at authentication, letting the user notice the intrusion in the account activity page of the application
• D.Session fixation is when an attacker pre-plants a known session ID on the victim (via URL parameter, subdomain cookie setting, or other means) before the victim logs in; if the server doesn't change the session ID upon authentication, the attacker's known ID becomes the victim's authenticated session. Prevention: regenerate the session ID immediately upon successful login, preserving any pre-login session data (like cart contents)