Access Control: Session Fixation¶

Identifier: session_fixation

Scanner Support¶

Description¶

Applications vulnerable to session fixation accept attacker-controlled session identifiers through authentication, allowing attackers to bind a known session to a victim account and hijack it after login.

How we test: We verify whether a session identifier supplied before authentication is preserved after login or other authentication state changes. A vulnerable application doesn't rotate or invalidate the pre-authentication session identifier when the user becomes authenticated.

References:

• https://owasp.org/www-community/attacks/Session_fixation
• https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

Configuration¶

Example¶

Example configuration:

---
security_tests:
  session_fixation:
    skip: false

Reference¶

skip¶

Type: boolean

Skip the test if true.