Session Fixation
Session fixation attacks force a user to use a session ID known to the attacker. When the user authenticates, the attacker can hijack the session using the pre-set session ID to gain unauthorized access.
Overview
Session Fixation is an attack technique where the attacker sets (fixes) a user's session identifier to a known value before the user authenticates. After the victim logs in with the fixed session ID, the attacker can use that same ID to access the authenticated session. This attack exploits applications that do not regenerate session identifiers after authentication.
Types & Variants
Cookie-Based Fixation
The attacker sets a known session cookie value in the victim's browser before authentication.
URL-Based Fixation
The session ID is passed as a URL parameter and the attacker tricks the victim into using it.
Impact
Account takeover, unauthorized access to authenticated sessions, data theft.
Examples
URL-Based Fixation
https://example.com/login?sessionid=attacker-known-session-id
Remediation
Regenerate session IDs after authentication, implement proper session invalidation, use secure cookie attributes, and validate session integrity.
Always regenerate session IDs after successful authentication
Do not accept session IDs from URL parameters
Set secure, HttpOnly, and SameSite cookie attributes
Implement absolute session timeout limits
Related SuperClue scanner checks
These scanner checks look for signs of Session Fixation. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works