It's also worth noting that the automatic testing tools may still have a false-positive for this issue when:
signed cookie session backend is in use
the testing tool is logging in and out of one test account
the testing tool does not wait at least 1 second between logins
This is an expected property of that session backend, and is not a bug. In all other cases, the session id should be different.
It's also worth noting that the automatic testing tools may still have a false-positive for this issue when:
signed cookie session backend is in use
the testing tool is logging in and out of one test account
the testing tool does not wait at least 1 second between logins
This is an expected property of that session backend, and is not a bug. In all other cases, the session id should be different.