Beginner LevelAuthentication & Authorization
What is a Session Fixation attack and how do you prevent it during login?
❓ Interview Prompt: Explain Session Fixation attack vectors, pre-authenticated session IDs, and session regeneration.
Session Fixation is an attack vector where an attacker tricks a victim into authenticating using a known session ID pre-set by the attacker.
Attack Scenario:
1
Attacker visits an application, obtains an anonymous session ID ('SID_999'), and sends a link containing 'SID_999' to the victim.
2
Victim logs into the application using the link.
3
If the application keeps 'SID_999' after authentication, the attacker now shares an authenticated session with the victim!
Mitigation:
Session Regeneration: Always destroy the anonymous session and issue a brand-new, cryptographically random Session ID immediately upon successful login!
Code Implementation Example
typescript
// Express.js session regeneration on login to prevent Session Fixation
app.post('/api/login', (req, res) => {
if (verifyCredentials(req.body.user, req.body.pass)) {
// Regenerate session ID immediately upon successful authentication!
req.session.regenerate((err) => {
if (err) return res.status(500).json({ error: 'Session regeneration failed' });
req.session.userId = 'user_1042'; // Assign user to fresh session ID
res.json({ message: 'Login successful' });
});
}
});💡Regenerating Express session ID immediately upon login to prevent session fixation.
🎯 Interview Key Takeaway
Always regenerate the session ID immediately upon user authentication to prevent session fixation attacks.
#Session Fixation#Security#Express#Session ID#Beginner
Back to all Authentication & Authorization Questions→