I am testing a web app and it works like this:
- user opens the page and is assigned a sessionId.
- user logs in, sessionId stays the same but user is also given an authToken.
- user logs out, authToken is deleted, sessionId changes.
- user logs back in, session Id is the same and a new autToken is given.
Is this app vulnerable to session fixation? I am confused because of the extra token that is given when the user logs in.