Session Fixation

intermediateAdditional Vector

Forcing a user to use a known session ID controlled by the attacker, then hijacking the session after authentication.

Detailed Overview

Session fixation exploits weak session management by pre-setting a victim's session ID before they authenticate. The attacker tricks the user into using a session identifier under the attacker's control. After the victim authenticates, the attacker uses the same session ID to gain unauthorized access. This attack is particularly effective against applications that don't regenerate session IDs upon login.

Prevention Strategies

01Regenerate session IDs after authentication
02Never accept session IDs from URL parameters
03Implement strict session validation
04Use secure session ID generation methods
05Educate users about phishing attempts

Tools

Common software used to explore or defend against this technique.

Burp Suite
OWASP ZAP
Browser DevTools
curl

BYO — Build your code

Programmatic approaches that recreate what tools do — for learning, detection, and hardening on systems you are authorized to test.

Rotate session ID on login

javascript

Express-style pattern: destroy pre-auth session and issue a new ID after credentials verify.

// Pseudocode for your own app's session middleware
async function login(req, res) {
  const user = await verifyCredentials(req.body);
  if (!user) return res.status(401).end();

  const oldData = { ...req.session };
  req.session.regenerate((err) => {
    if (err) return res.status(500).end();
    Object.assign(req.session, oldData, { userId: user.id });
    res.redirect("/app");
  });
}

Reject session IDs in the URL

typescript

Middleware that strips or blocks sid-like query parameters.

const SID = /^(session|sid|jsessionid|phpsessid)$/i;

export function blockSessionInQuery(query: Record<string, string>) {
  return Object.keys(query).some((k) => SID.test(k));
}