# Session Fixation (CWE-384)

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

**Stack:** Go

- Prevalence: Średnia Pokryto 3 języków
- Impact: Wysoki 3 reguł o wysokim poziomie
- Prevention: Udokumentowane 3 przykładów poprawek

**OWASP:** Identification and Authentication Failures (A07:2021-Identification and Authentication Failures) - #7

## Description

In a session fixation attack, the attacker sets a user's session ID to a known value before the user authenticates. After authentication, the attacker can use the known session ID to hijack the authenticated session.

## Prevention

Strategie zapobiegania dla Session Fixation oparte na 1 regułach detekcji Shoulder.

### Key Practices

- Use predictable values or cookies lack Secure/HttpOnly flags

### Go

Use crypto/rand for session IDs with Secure, HttpOnly, and SameSite cookie flags

## Warning Signs

- [HIGH] Session management has security weaknesses

## Consequences

- Uzyskanie uprawnień
- Obejście mechanizmu ochrony

## Mitigations

- Po pomyślnym uwierzytelnieniu regeneruj identyfikatory sesji
- Tworząc nowe sesje, unieważniaj poprzednie
- Stosuj bezpieczne biblioteki zarządzania sesją

## Detection

- Total rules: 3
- Languages: javascript, typescript, go, python

## Rules by Language

### Go (1 rules)

- **Insecure Session Management** [HIGH]: Session IDs use predictable values or cookies lack Secure/HttpOnly flags.
  - Remediation: Use crypto/rand for session IDs and set secure cookie flags.

```go
b := make([]byte, 32)
rand.Read(b)
sessionID := base64.URLEncoding.EncodeToString(b)

http.SetCookie(w, &http.Cookie{
    Name:     "session_id",
    Value:    sessionID,
    HttpOnly: true,
    Secure:   true,
    SameSite: http.SameSiteStrictMode,
})
```

Learn more: https://shoulder.dev/learn/go/cwe-384/insecure-session-management