Session Fixation

web security

Definition

Session Fixation

Session fixation is a full-session hijack that becomes possible when an attacker can violate the integrity of the victim’s cookies — the typical setting is a same-site attacker — and the application does not refresh the session id on login.

1. The attacker visits bank.com and receives a pre-auth session id s_atk.
2. The victim visits evil.bank.com, which sets Set-Cookie: sid=s_atk; domain=bank.com in the victim’s browser.
3. The victim logs in to bank.com. Domain cookies are attached, so s_atk is sent and promoted to the victim’s authenticated session identifier.
4. The attacker, who knows s_atk, can now use the victim’s authenticated session.

Fix

Rotate the session identifier on every privilege change — in particular on successful login. A fresh id at login defeats fixation regardless of how the old id was planted.