Session Fixation

Session fixation is a web attack in which the attacker gets a victim to use a session identifier the attacker already knows. If the application keeps that same identifier after login, the attacker's copy of the ID becomes an authenticated session.

Why it matters

Unlike session hijacking, the attacker does not need to steal an ID after the fact. They plant it: through a URL parameter such as ?PHPSESSID=abc, a cookie set from a sibling subdomain or through injected markup. After the victim signs in, the attacker presents the same ID and is logged in as the victim.

The core defense is simple and should be built into every login flow: issue a new session ID when privilege changes. Accepting session IDs only from cookies, not URLs, and using cookie prefixes also help.

Example

In PHP:

if (password_verify($input, $hash)) {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $user['id'];
}

The true argument deletes the old session data. Frameworks such as Django and Rails rotate IDs on login by default, but custom code often does not.

Common mistakes

• Regenerating the ID only at the start of a session, not after login or privilege change.
• Accepting session IDs in query strings.
• Leaving the old session valid after logout.

Related

• Session hijacking
• Session
• Cookie prefixes
• HttpOnly cookie

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.