Sessionfixering

Sessionfixering, or session fixation, is a web security vulnerability in which an attacker causes a user to use a known or predictable session identifier. If the user logs in without the server issuing a fresh session ID, the attacker may be able to use the same session ID to access the authenticated session.

How it works can vary, but the common pattern is that the attacker obtains a valid session ID or induces the user to use a link or page that assigns one. The user then authenticates with that session ID. If the application does not regenerate a new session identifier upon successful login, the attacker can reuse the same ID to access the account after login, effectively hijacking the session.

Modern web applications mitigate sessionfixering by ensuring that a new session ID is issued at login and that old sessions are invalidated. Other defenses include setting session cookies with HttpOnly and Secure attributes, using SameSite policies to limit cross-site usage, and enforcing short session timeouts or idle expirations. Binding sessions to additional factors such as IP address or user-agent can provide extra protection, though these checks must be balanced against legitimate user mobility. Implementing TLS for all authentication flows and employing anti-CSRF protections for state-changing requests are complementary defenses.

In practice, many contemporary frameworks and platforms provide built-in protections against sessionfixering, making successful exploitation less common. Nevertheless, developers should explicitly implement session ID rotation on authentication and monitor session usage for anomalies to reduce risk.