An attacker may trick a user into using a predetermined session identifier. Consequently, this attacker can gain unauthorized access and impersonate the user’s session. This kind of attack is called session fixation, and protections against it should not be disabled.

## Why is this an issue?

Session fixation attacks take advantage of the way web applications manage session identifiers. Here’s how a session fixation attack typically works:

- When a user visits a website or logs in, a session is created for them.
- This session is assigned a unique session identifier, stored in a cookie, in local storage, or through URL parameters.
- In a session fixation attack, an attacker tricks a user into using a predetermined session identifier controlled by the attacker. For example, the attacker sends the victim an email containing a link with this predetermined session identifier.
- When the victim clicks on the link, the web application does not create a new session identifier but uses this identifier known to the attacker.
- At this point, the attacker can hijack and impersonate the victim’s session.

### What is the potential impact?

Session fixation attacks pose a significant security risk to web applications and their users. By exploiting this vulnerability, attackers can gain unauthorized access to user sessions, potentially leading to various malicious activities. Some of the most relevant scenarios are the following:

#### Impersonation

Once an attacker successfully fixes a session identifier, they can impersonate the victim and gain access to their account without providing valid credentials. This can result in unauthorized actions, such as modifying personal information, making unauthorized transactions, or even performing malicious activities on behalf of the victim. An attacker can also manipulate the victim into performing actions they wouldn’t normally do, such as revealing sensitive information or conducting financial transactions on the attacker’s behalf.

#### Data Breach

If an attacker gains access to a user’s session, they may also gain access to sensitive data associated with that session. This can include personal information, financial details, or any other confidential data that the user has access to within the application. The compromised data can be used for identity theft, financial fraud, or other malicious purposes.

#### Privilege Escalation

In some cases, session fixation attacks can be used to escalate privileges within a web application. By fixing a session identifier with higher privileges, an attacker can bypass access controls and gain administrative or privileged access to the application. This can lead to unauthorized modifications, data manipulation, or even complete compromise of the application and its underlying systems.

### How to fix it in Symfony

### Code examples

In a Symfony Security’s context, session fixation protection can be disabled with the value `none` for the `session_fixation_strategy` attribute.

Session fixation protection is enabled by default in Symfony. It can be explicitly enabled with the values `migrate` and `invalidate` for the `session_fixation_strategy` attribute.

#### Noncompliant code example

    namespace Symfony\Component\DependencyInjection\Loader\Configurator;

    return static function (ContainerConfigurator $container) {
        $container->extension('security', [
            'session_fixation_strategy' => 'none', // Noncompliant
        ]);
    };

#### Compliant solution

    namespace Symfony\Component\DependencyInjection\Loader\Configurator;

    return static function (ContainerConfigurator $container) {
        $container->extension('security', [
            'session_fixation_strategy' => 'migrate',
        ]);
    };

### How does this work?

The protection works by ensuring that the session identifier, which is used to identify and track a user’s session, is changed or regenerated during the authentication process.

Here’s how session fixation protection typically works:

1. When a user visits a website or logs in, a session is created for them. This session is assigned a unique session identifier, which is stored in a cookie or passed through URL parameters.
2. In a session fixation attack, an attacker tricks a user into using a predetermined session identifier controlled by the attacker. This allows the attacker to potentially gain unauthorized access to the user’s session.
3. To protect against session fixation attacks, session fixation protection mechanisms come into play during the authentication process. When a user successfully authenticates, this mechanism generates a new session identifier for the user’s session.
4. The old session identifier, which may have been manipulated by the attacker, is invalidated and no longer associated with the user’s session. This ensures that any attempts by the attacker to use the fixed session identifier are rendered ineffective.
5. The user is then assigned the new session identifier, which is used for subsequent requests and session tracking. This new session identifier is typically stored in a new session cookie or passed through URL parameters.

By regenerating the session identifier upon authentication, session fixation protection helps ensure that the user’s session is tied to a new, secure identifier that the attacker cannot predict or control. This mitigates the risk of an attacker gaining unauthorized access to the user’s session and helps maintain the integrity and security of the application’s session management process.

## Resources

### Documentation

Security Configuration Reference - Session Fixation Strategy

### Standards

- OWASP - Top 10 2021 Category A7 - Identification and Authentication Failures
- OWASP - Top 10 2017 Category A2 - Broken Authentication
- OWASP Sesssion Fixation
- CWE - CWE-384 - Session Fixation
- STIG Viewer - Application Security and Development: V-222579 - Applications must use system-generated session identifiers that protect against session fixation.
- STIG Viewer - Application Security and Development: V-222582 - The application must not re-use or recycle session IDs.