# Session Fixation (CWE-384)

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

**Stack:** JavaScript

- Prevalence: 보통 3개 언어 지원
- Impact: 높음 3개의 높은 심각도 규칙
- Prevention: 문서화됨 3개의 수정 예시

**OWASP:** Identification and Authentication Failures (A07:2021-Identification and Authentication Failures) - #7

## Description

In a session fixation attack, the attacker sets a user's session ID to a known value before the user authenticates. After authentication, the attacker can use the known session ID to hijack the authenticated session.

## Prevention

1개의 Shoulder 탐지 규칙을 기반으로 한 Session Fixation 예방 전략.

### JavaScript

Configure sessions with environment-based secrets and secure cookie flags

## Warning Signs

- [HIGH] Session configuration has security vulnerabilities
- [HIGH] insecure session configuration including weak secrets, insecure cookies, and missing security flags

## Consequences

- 권한 획득
- 보호 메커니즘 우회

## Mitigations

- 인증에 성공한 후 세션 ID를 재생성하세요
- 새 세션을 생성할 때 이전 세션을 무효화하세요
- 안전한 세션 관리 라이브러리를 사용하세요

## Detection

- Total rules: 3
- Languages: javascript, typescript, go, python

## Rules by Language

### Javascript (1 rules)

- **Express Insecure Session Configuration** [HIGH]: Detects insecure session configuration including weak secrets, insecure cookies, and missing security flags.
  - Remediation: Configure sessions with secure settings and environment-based secrets.

```javascript
const session = require('express-session');

app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: {
    secure: process.env.NODE_ENV === 'production',
    httpOnly: true,
    sameSite: 'strict',
    maxAge: 1000 * 60 * 60 * 24
  },
  resave: false,
  saveUninitialized: false
}));
```

Learn more: https://shoulder.dev/learn/javascript/cwe-384/express-session-configuration

### Typescript (1 rules)

- **Express Insecure Session Configuration** [HIGH]: Detects insecure session configuration including weak secrets, insecure cookies, and missing security flags.
  - Remediation: Configure sessions with secure settings and environment-based secrets.

```javascript
const session = require('express-session');

app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: {
    secure: process.env.NODE_ENV === 'production',
    httpOnly: true,
    sameSite: 'strict',
    maxAge: 1000 * 60 * 60 * 24
  },
  resave: false,
  saveUninitialized: false
}));
```

Learn more: https://shoulder.dev/learn/javascript/cwe-384/express-session-configuration