Session fixation prevented: new session ID on login

Session fixation (CWE-384) is an attack where an adversary pre-sets a known session ID — via a URL parameter, cookie injection, or a shared link — then waits for the victim to authenticate. If the server preserves the pre-authentication session ID after login, the attacker's known ID becomes an authenticated session without any credential theft. OWASP A07 and CAPEC-61 document this attack class. NIST IA-2 requires unique session identification per authenticated principal. In a financial application, a fixation attack grants the attacker a fully authenticated session capable of initiating transfers. The fix is a single call to session.regenerate() on every login path — omitting it is the entire vulnerability.

Call session.regenerate() immediately after credential verification in src/app/api/auth/login/route.ts — the new session ID must be cryptographically random and independent of the pre-login ID:

export async function POST(req: Request) {
  const { email, password } = await req.json();
  const user = await authenticateUser(email, password);
  if (!user) {
    return Response.json({ error: 'Invalid credentials' }, { status: 401 });
  }

  // CRITICAL: discard the pre-login session, issue a new ID
  await new Promise<void>((resolve, reject) =>
    req.session.regenerate((err) => err ? reject(err) : resolve())
  );
  req.session.userId = user.id;
  await new Promise<void>((resolve, reject) =>
    req.session.save((err) => err ? reject(err) : resolve())
  );

  return Response.json({ ok: true });
}

Verify that regenerate() is called in every login code path, including OAuth callbacks and SSO endpoints — not just the primary email/password route.