A city admin portal keeps the same session identifier after a user elevates from read-only staff to full administrator. What session hygiene issue should the tester flag?
Select an answer to reveal the explanation.
Short Explanation
Getting a promotion should come with a new badge, not the old visitor sticker. Keeping the same session ID after privilege elevation is classic fixation/elevation hygiene failure. Marketing cookies are not the model here.
Full Explanation
Applications should issue a new session identifier at authentication and again when privileges change so pre-login or lower-privilege identifiers cannot be reused for higher access. Failure to rotate enables session fixation and prolongs stolen-session impact across elevation. The requirement is unrelated to marketing cookies. Testers should recommend rotation plus secure cookie attributes on administrative portals.