| name | session-fixation-anti-pattern |
| description | Security anti-pattern for session fixation vulnerabilities (CWE-384). Use when generating or reviewing code that handles user sessions, login flows, or authentication state changes. Detects failure to regenerate session IDs after authentication. |
Session Fixation Anti-Pattern
Severity: High
Summary
Attackers fix a user's session ID before login. The attacker obtains a valid session ID, tricks the victim into using it, and when authentication fails to regenerate the session ID, hijacks the victim's authenticated session.
The Anti-Pattern
The anti-pattern is reusing the same session ID before and after authentication.
BAD Code Example
from flask import Flask, session, redirect, url_for, request
app = Flask(__name__)
app.secret_key = 'your_secret_key'
@app.route('/')
def index():
if 'username' in session:
return f'Hello {session["username"]}! <a href="/logout">Logout</a>'
return 'Welcome, please <a href="/login">Login</a>'
@app.route('/login', methods=['GET', 'POST'])
def login():
if request.method == 'POST':
username = request.form['username']
password = request.form['password']
if check_credentials(username, password):
session['username'] = username
return redirect(url_for('index'))
return 'Invalid credentials'
return '''
<form method="post">
<p><input type=text name=username></p>
<p><input type=password name=password></p>
<p><input type=submit value=Login></p>
</form>
'''
GOOD Code Example
from flask import Flask, session, redirect, url_for, request
app = Flask(__name__)
app.secret_key = 'your_secret_key'
@app.route('/')
def index_secure():
if 'username' in session:
return f'Hello {session["username"]}! <a href="/logout">Logout</a>'
return 'Welcome, please <a href="/login_secure">Login Securely</a>'
@app.route('/login_secure', methods=['GET', 'POST'])
def login_secure():
if request.method == 'POST':
username = request.form['username']
password = request.form['password']
if check_credentials(username, password):
session.regenerate()
session['username'] = username
return redirect(url_for('index_secure'))
return 'Invalid credentials'
return '''
<form method="post">
<p><input type=text name=username></p>
<p><input type=password name=password></p>
<p><input type=submit value=Login></p>
</form>
'''
@app.route()
():
session.clear()
session.regenerate()
redirect(url_for())
Detection
- Review login flows: Trace the code paths involved in user authentication. Verify that after a successful login, the application explicitly invalidates the old session and generates a completely new session ID.
- Check session management libraries: Understand how your web framework or session management library handles session ID generation and regeneration. Ensure it's used correctly.
- Test with a fixed session ID: Manually attempt to set a session ID (e.g., using browser developer tools or a proxy like Burp Suite) before logging in. After logging in, check if the session ID remains the same.
Prevention
Related Security Patterns & Anti-Patterns
References
