No session rotation on login

[MoralinFrost]

Description

Couldn't find settings for cb-session-id rotation on login. I have the same session cookie before and after successful authentication. I suppose this can cause session fixation attack

Steps to reproduce

1. open cloudbeaver without authentication in one browser and take its session id
2. open cloudbeaver in incognito mode, paste session id and log in
3. refresh page opened in first step - you'll be logged in as a user from second step

Expected/Desired Behavior

Provide new cb-session-id after successful login

CloudBeaver Version

CloudBeaver Community 26.0.1

Additional context

No response

[EvgeniaBzzz]

Hi @MoralinFrost
The fact that the session does not change when transitioning from anonymous to an authenticated user is expected behavior. However, we will update the session token handling to make it secure.
Thank you for the report 🦫