diff --git a/max/auth/auth.py b/max/auth/auth.py
index 774bd06..46adc1e 100644
--- a/max/auth/auth.py
+++ b/max/auth/auth.py
@@ -22,6 +22,8 @@ def login(email, password):
     if not user.enabled:
         return t("This account is not enabled!")
 
+    # Start a new session (new id, new CSRF token) against session fixation.
+    session.clear()
     session["user_id"] = user.id
     return None
 
diff --git a/max/sessions.py b/max/sessions.py
index 335740d..f8c9732 100644
--- a/max/sessions.py
+++ b/max/sessions.py
@@ -134,8 +134,12 @@ class SessionInterface(FlaskSessionInterface):
             session_id = session_id.decode("utf-8", "strict")
 
         data = session_storage[session_id]
+        if data is None:
+            # Never adopt an id chosen by the client (session fixation)
+            return self.make_session_object()
+
         session = self.make_session_object(session_id, data=data)
-        if data is not None and session.is_expired(time.monotonic()):
+        if session.is_expired(time.monotonic()):
             del session_storage[session_id]
             return self.make_session_object()
         return session