Reliable protection against session fixation attacks

Abstract

The term 'Session Fixation vulnerability' subsumes issues in Web applications that under certain circumstances enable the adversary to perform a Session Hijacking attack through controlling the victim's session identifier value. A successful attack allows the attacker to fully impersonate the victim towards the vulnerable Web application. We analyse the vulnerability pattern and identify its root cause in the separation of concerns between the application logic, which is responsible for the authentication processes, and the framework support, which handles the task of session tracking. Based on this result, we present and discuss three distinct server-side measures for mitigating Session Fixation vulnerabilities. Each of our countermeasures is tailored to suit a specific real-life scenario that might be encountered by the operator of a vulnerable Web application.

BetterAuth

“…• The authenticated cookie is secured against JavaScript read access by the HTTPonly cookie attribute [28]. • The value of the authenticated cookie is changed every time the authorization level of the user changes to combat potential session fixation vulnerabilities [21]. • State-changing interfaces are secured against CSRF using server-side checking of security nonces [33] or strict enforcement of matching origin HTTP response header [3].…”

“…While this problem is partially addressed with currently experimental browser features [6,2], the only reliable way for an application to mitigate this attack, is to renew the cookie's value each time the authorization level of the user changes [21].…”

Serene: Self-Reliant Client-Side Protection against Session Fixation

“…Furthermore, Johns et al [8] have proposed two more server-side solutions for combating session fixation attacks against cookie-based session management. One consists of instrumenting the underlying web framework, to automatically regenerate the SID when an authentication process is detected.…”

Sound and Static Analysis of Session Fixation Vulnerabilities in PHP Web Applications

“…To defend against this type of attacks, previous works [3,4,5] either detect the vulnerability by dynamically monitoring session values or protect the users by introducing additional SIDs that complement the already existing authentication mechanism. However, dynamic approaches are limited, in the sense that only certain attack scenarios are tested.…”