Session is not regenerated after successful login. An attacker who can set a session cookie before login can hijack the session after the user authenticates.
Suggested fix: Regenerate the session ID (create new session, copy data, destroy old) after successful authentication.
## From Security Audit ([#33 comment](https://git.eeqj.de/sneak/webhooker/issues/33#issuecomment-10915))
**Severity: BLOCKER**
Session is not regenerated after successful login. An attacker who can set a session cookie before login can hijack the session after the user authenticates.
**Suggested fix:** Regenerate the session ID (create new session, copy data, destroy old) after successful authentication.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
From Security Audit (#33 comment)
Severity: BLOCKER
Session is not regenerated after successful login. An attacker who can set a session cookie before login can hijack the session after the user authenticates.
Suggested fix: Regenerate the session ID (create new session, copy data, destroy old) after successful authentication.