Session fixation - a commonly-used session-based attack - can be prevented simply by giving a user a new session ID whenever they obtain a new level of permissi

Session fixation - a commonly-used session-based attack - can be prevented simply by giving a user a new session ID whenever they obtain a new level of permission on a site (for instance, after they successfully login).