Take the 2-minute tour ×  Most of the session fixation topics in
ruby are mostly related to rails. Are there any session fixation
vulnerabilities in sinatra? In rails we are mostly recommended
to do reset_session before assigning sessions. How can we
prevent session fixation in sinatra?  share|improve this
question add comment  1 Answer  up vote 2 down vote accepted
Sinatra by default uses the Rack::Protection gem which protects
against a lot of common vulnerabilities. You might be
particularly interested in its session hijacking protection.
These are some of the things the Rack::Protection gem protects
against:  Cross Site Request Forgery  Authenticity token: Only
accepts unsafe HTTP requests if a given access token matches the
token included in the session. Form token: Only accepts
submitted forms if a given access token matches the token
included in the session. Does not expect such a token from Ajax
request. Remote token: Only accepts unsafe HTTP requests if a
given access token matches the token include