3 ms·

Not true, two pretty different techniques. Forcing is about dropping HTTP cookies to https using mitm Fixation is session riding

• ef4 13y ago
  I disagree. The point in either case is to get a cookie of the attacker's choosing accepted as the session identifier for the privileged domain. But even if we consider them separate techniques, the mitigation strategy is identical anyway.
  • homakov 13y ago
    Yes mitigation is identical