I am testing website security when I came across this:
When I enter the site URL, the user is given a session ID without any user input like:
7F746326038B30F51609423B2086BEBB
Scenario 1: Once I logged into the website by providing the correct credentials, it logs in but the session ID remains the same. In the same session, I logged out again to see that the session ID was still not changed. Again logging in gives the same session ID.
Is this a potential vulnerability of the website? Can session fixation or hijacking be performed around this?
Scenario 2: What if the site gives a session ID when the user lands on the login page and does not change it after login, but it gets changed after logout and goes on? Is this also a vulnerability?
Scenario 3: I am logging out of the current user and logging in again as a different user. The session id is still the same.
Note: The site is using HTTPS and HTTP only and Secure flags are enabled for the Cookie.