Session Fixation

Also Known As

TL;DR

Explanation

Session fixation occurs when an application accepts a session ID supplied by the attacker (via URL parameter or cookie) and reuses it after the user logs in. The attacker sets a known session ID, waits for the victim to authenticate, then uses the same ID to access the authenticated session. Prevention: always call session_regenerate_id(true) immediately after a successful login to generate a fresh session ID and invalidate the old one.

Diagram

sequenceDiagram
    participant A as Attacker
    participant V as Victim
    participant S as Server
    A->>S: GET /login
    S-->>A: Set session ID: abc123
    A->>V: Send link with ?PHPSESSID=abc123
    V->>S: Login with credentials + session abc123
    S-->>S: Authenticates user to session abc123
    Note over A,S: Attacker already has session abc123!
    A->>S: Request with session abc123
    S-->>A: Returns victim's authenticated session
    Note over S: Fix: session_regenerate_id(true) after login

Common Misconception

Why It Matters

Common Mistakes

• Not calling session_regenerate_id(true) immediately after a successful login.
• Regenerating the ID but not deleting the old session — the old ID remains valid.
• Accepting session IDs from URL parameters (?PHPSESSID=) — only accept them from cookies.
• Setting session cookie without Secure and HttpOnly flags — the cookie can be read over HTTP or via JavaScript.

Code Examples

// Session ID never regenerated after login — attacker can pre-set it
session_start();
$_SESSION['user_id'] = $user->id; // same session ID before and after auth

session_start();

// After successful authentication — always regenerate
session_regenerate_id(true); // true = delete old session file
$_SESSION['user_id'] = $user->id;

// Also regenerate on privilege escalation (sudo/admin mode)

References

• ↗ https://owasp.org/www-community/attacks/Session_fixation
• ↗ https://cwe.mitre.org/data/definitions/384.html

Tags

Related Terms