1. Executive Summary & Scope
Session Fixation occurs when an application does not assign a new session identifier when a user authenticates, allowing an attacker who pre-established a known session ID in the victim's browser to inherit authenticated access once the victim logs in.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-384 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
An attacker sends a crafted link setting `PHPSESSID=attacker_token`. The victim clicks and authenticates; the attacker now uses the same session ID to access the victim's account.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
// VULNERABLE: Login succeeds without regenerating session ID
if (password_verify($password, $user['password_hash'])) {
$_SESSION['authenticated'] = true;
$_SESSION['user_id'] = $user['id'];
// Insecure: Session ID unchanged!
}
Hardened Defense-in-Depth Implementation
// REMEDIATED: Mandatory session regeneration with old session deletion
if (password_verify($password, $user['password_hash'])) {
// Destroy previous session data and regenerate new cryptographic session ID
session_regenerate_id(true);
$_SESSION['authenticated'] = true;
$_SESSION['user_id'] = $user['id'];
$_SESSION['created_at'] = time();
$_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT'] ?? '';
}
// Mandatory Production Cookie Configuration:
session_set_cookie_params([
'lifetime' => 0, // Expire when browser closes
'path' => '/',
'domain' => 'webotg.com',
'secure' => true, // HTTPS only
'httponly' => true, // Inaccessible to JavaScript
'samesite' => 'Lax' // CSRF protection
]);
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| Pre-Auth Session ID Inspection | Capture cookie value before and after successful login. | Cookie value is completely replaced with new cryptographic string upon authentication. |
| HttpOnly and Secure Flags | Inspect `Set-Cookie` header in browser network inspector. | Flags `Secure`, `HttpOnly`, and `SameSite=Lax` or `Strict` are present on all session cookies. |
| Logout Invalidation Verification | Submit previous session cookie after clicking logout. | Server returns 401/302 and prevents access to authenticated pages. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.