Broken Authentication in Django

Broken Authentication in Django applications typically exploits weaknesses in how Django handles session management, password policies, and authentication flows. Unlike generic web frameworks, Django's authentication system has specific implementation details that attackers can target.

One common attack vector is session fixation. Django generates session IDs that, if not properly invalidated during login, allow attackers to force a user into a known session. This occurs when developers call login() without first calling django.contrib.auth.logout() or creating a new session: