Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
In a session fixation attack, the attacker sets a user's session ID to a known value before the user authenticates. After authentication, the attacker can use the known session ID to hijack the authenticated session.
この脆弱性の修正方法
3 件の Shoulder 検出ルールに基づく Session Fixation の予防策。
Configure sessions with environment-based secrets and secure cookie flags
app.use(session({ - secret: 'keyboard cat', - resave: true, - saveUninitialized: true + secret: process.env.SESSION_SECRET, + cookie: { + secure: process.env.NODE_ENV === 'production', + httpOnly: true, + sameSite: 'strict', + maxAge: 1000 * 60 * 60 * 24 + }, + resave: false, + saveUninitialized: false }));
Use crypto/rand for session IDs with Secure, HttpOnly, and SameSite cookie flags
func createSession(w http.ResponseWriter, r *http.Request) { - sessionID := fmt.Sprintf("%d", time.Now().Unix()) - http.SetCookie(w, &http.Cookie{ - Name: "session_id", - Value: sessionID, + b := make([]byte, 32) + rand.Read(b) + sessionID := base64.URLEncoding.EncodeToString(b) + http.SetCookie(w, &http.Cookie{ + Name: "session_id", + Value: sessionID, + HttpOnly: true, + Secure: true, + SameSite: http.SameSiteStrictMode, + MaxAge: 3600, }) }
Regenerate the session ID immediately after successful authentication
from flask import session, request from flask_login import login_user - @app.route('/login', methods=['POST']) - def login(): - user = User.query.filter_by(username=request.form['username']).first() - if user and check_password(user.password, request.form['password']): + def regenerate_session(): + data = dict(session) + session.clear() + session.update(data) + + @app.route('/login', methods=['POST']) + def login(): + user = User.query.filter_by(username=request.form['username']).first() + if user and check_password(user.password, request.form['password']): + regenerate_session() login_user(user) return redirect('/dashboard')
主要なプラクティス
- Use predictable values or cookies lack Secure/HttpOnly flags
- Use a session ID that the attacker already knows
コードの脆弱性を見つける
Shoulderを使用してコードのSession Fixationパターンをスキャンしましょう。 3 ルール.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=384 # Or scan entire project npx @shoulderdev/cli trust .
検出ルール (3)
コードレビューで注目すべき点
これらのパターンはSession Fixationの潜在的な脆弱性を示しています。コードレビューとセキュリティ監査中に探してください。