High ThreatAuthentication & TokensCWE-384
Secure Web Session Management & Fixation Defense
Implement secure web session management by enforcing rotation on login, invalidation, and using distributed Redis stores.
Vulnerability Overview
Reusing session IDs across privilege changes allows session fixation.
Attacker forces a known session ID onto a user, who then logs in.
Vulnerable Code
req.session.user = user;Maintains the same session ID post-login.
Remediated Code
req.session.regenerate(() => { req.session.user = user; });Generates a new session ID upon login.
Hardening Rules
- 1Regenerate session on login
- 2Set secure flag on cookies
- 3Implement idle timeouts
Frequently Asked Questions
What is session fixation?
When an attacker sets a user session ID before they authenticate, hijacking the session once logged in.