auditing-session-lifecycle-and-fixation

name	auditing-session-lifecycle-and-fixation
description	Audit how an application issues, rotates, and destroys session identifiers, so an attacker cannot fixate or outlive a session. Covers a session identifier not regenerated at login or privilege change, a logout that clears the client cookie but leaves the server session valid, a session that never expires or has no idle or absolute timeout, an identifier accepted from a URL or a header an attacker can seed, a session cookie missing the secure, http-only, or same-site attributes, and a cookie scoped to a parent domain shared with untrusted subdomains. Use when reviewing authentication, logout, and session-management code and the cookie attributes it sets; it assumes the identifier is unguessable and scopes to lifecycle, not entropy. An attacker who can set or keep a session identifier is the source, the victim authenticating into it is the sink, and a session that is not rotated or invalidated is the bug.
license	MIT

Auditing session lifecycle and fixation: whether a session is rotated, scoped, and destroyed

A session identifier can be perfectly random and still be a bug, because the attack is not guessing it but controlling its lifecycle. If the identifier issued to an anonymous visitor survives unchanged into their authenticated session, an attacker who planted it now holds that session; if logout clears only the client cookie, a captured identifier stays valid; if nothing expires, a stolen identifier lives forever. This audit assumes the identifier is unguessable, that is a separate concern, and asks whether it is rotated at the right moments, invalidated when it should be, timed out, and scoped so only the right party can hold it. You audit it by reading the login, privilege-change, and logout paths and the cookie attributes, against the framework's session defaults. The discipline is checking those defaults first, because the rotation or the attribute is often set centrally, not at the call site.