From the course: Programming Foundations: Web Security

Unlock the full course today

Join today to access over 24,900 courses taught by industry experts.

Session fixation

Session fixation

From the course: Programming Foundations: Web Security

Start my 1-month free trial Buy for my team

Session fixation

“

- Session fixation is an attack where the attacker provides a user with a valid session identifier. It's similar to session hijacking, but reversed. Instead of stealing a user's session ID, the attacker gives the user a session ID, one which the attacker controls. In both cases, the result will be that the user and the attacker are using the same session identifier. The purpose of the attack is also the same. An attacker can assume the user's identity and share their access privileges. Of course, the session that the attacker provides will not be authenticated. It won't be attached to a logged-in user yet. The attacker has to wait patiently. When the user eventually logs into the website again, the application stores a bit of data in the session file to remember that the user has logged in and should be allowed to view other pages. Now the attacker can take advantage of the shared session and visit access-restricted…

Contents