Intermediate LevelWeb Security & Cyber Defense
How do you defend against Session Fixation by regenerating session identifiers on privilege escalation?
❓ Interview Prompt: Explain Session Fixation attacks, pre-session IDs, session fixation exploitation, and session regeneration on login/logout.
Session Fixation occurs when an attacker forces a victim to use a known session ID chosen by the attacker:
Attack Mechanics:
1
Attacker obtains an anonymous session ID 'SID_99' from a target site.
2
Attacker tricks victim into clicking a link with 'SID_99' embedded in a query parameter or cookie.
3
Victim logs into the site. If the server keeps 'SID_99' active after login, the attacker uses 'SID_99' to access the victim's account!
•
Defense: Always regenerate the session ID immediately upon successful authentication or privilege escalation.
Code Implementation Example
typescript
app.post('/login', async (req, res) => {
const user = await authenticateUser(req.body);
// ✅ SECURE: Regenerate session ID upon successful login!
req.session.regenerate((err) => {
req.session.userId = user.id;
res.json({ status: 'Logged In' });
});
});💡Regenerating session IDs upon user login in Express session middleware.
🎯 Interview Key Takeaway
Always regenerate session IDs upon user login, logout, or privilege escalation to prevent Session Fixation attacks.
#Session Fixation#Session Security#Authentication#Intermediate
Back to all Web Security & Cyber Defense Questions→