Session fixation

In short: In session fixation an attacker plants a known session ID on the victim. If the victim logs in with it, the attacker knows the now authenticated session.

In more detail: The flaw lies in the application, which does not renew the session ID at login.

In Depth

• Sequence: 1. The attacker obtains a valid, not yet logged-in session. 2. He makes the victim use that ID (link with ID, manipulated cookie). 3. The victim logs in, the ID stays the same. 4. The attacker uses the ID.
• Main defence: After login, privilege change and logout always issue a new session ID and invalidate the old one.
• Further measures: Never IDs in URLs, cookies with HttpOnly, Secure and SameSite, short lifetime, keep the session valid server-side.
• Related: Session hijacking steals an existing ID (for example via XSS). Fixation sets it beforehand.
• Frameworks: Good frameworks renew the ID at login automatically. Home-made sessions are at risk.

See also: CSRF