In this recipe, we examined how the PHPSESSID value assigned to an unauthenticated user remained constant even after authentication. This is a security vulnerability allowing for the session fixation attack.