Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
In a session fixation attack, the attacker sets a user's session ID to a known value before the user authenticates. After authentication, the attacker can use the known session ID to hijack the authenticated session.
이 취약점을 수정하는 방법
3개의 Shoulder 탐지 규칙을 기반으로 한 Session Fixation 예방 전략.
Configure sessions with environment-based secrets and secure cookie flags
app.use(session({ - secret: 'keyboard cat', - resave: true, - saveUninitialized: true + secret: process.env.SESSION_SECRET, + cookie: { + secure: process.env.NODE_ENV === 'production', + httpOnly: true, + sameSite: 'strict', + maxAge: 1000 * 60 * 60 * 24 + }, + resave: false, + saveUninitialized: false }));
Use crypto/rand for session IDs with Secure, HttpOnly, and SameSite cookie flags
func createSession(w http.ResponseWriter, r *http.Request) { - sessionID := fmt.Sprintf("%d", time.Now().Unix()) - http.SetCookie(w, &http.Cookie{ - Name: "session_id", - Value: sessionID, + b := make([]byte, 32) + rand.Read(b) + sessionID := base64.URLEncoding.EncodeToString(b) + http.SetCookie(w, &http.Cookie{ + Name: "session_id", + Value: sessionID, + HttpOnly: true, + Secure: true, + SameSite: http.SameSiteStrictMode, + MaxAge: 3600, }) }
Regenerate the session ID immediately after successful authentication
from flask import session, request from flask_login import login_user - @app.route('/login', methods=['POST']) - def login(): - user = User.query.filter_by(username=request.form['username']).first() - if user and check_password(user.password, request.form['password']): + def regenerate_session(): + data = dict(session) + session.clear() + session.update(data) + + @app.route('/login', methods=['POST']) + def login(): + user = User.query.filter_by(username=request.form['username']).first() + if user and check_password(user.password, request.form['password']): + regenerate_session() login_user(user) return redirect('/dashboard')
핵심 실천 사항
- Use predictable values or cookies lack Secure/HttpOnly flags
- Use a session ID that the attacker already knows
코드에서 취약점 찾기
Shoulder를 사용하여 코드에서 Session Fixation 패턴을 스캔하세요. 3 규칙.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=384 # Or scan entire project npx @shoulderdev/cli trust .
탐지 규칙 (3)
코드 리뷰에서 주의할 점
이 패턴은 잠재적인 Session Fixation 취약점을 나타냅니다. 코드 리뷰와 보안 감사 중에 찾아보세요.