Home >> Taxonomy >> Attacks >> Session fixation

Session Fixation

Session fixation is a security attack where an attacker sets a user's session identifier, aiming to hijack their session and gain unauthorized access.

Example

In 2011, security researcher Rishi Narang discovered a session fixation vulnerability on LinkedIn. The vulnerability allowed an attacker to set a user's session ID to a known value, potentially leading to session hijacking. The issue stemmed from LinkedIn's handling of session identifiers during the login process. The vulnerability was patched.

Links

• Security expert finds vulnerability in LinkedIn
• Session fixation | OWASP Foundation

Cards

Authorization

• Authorization 7

Session-management

• Session-management 2
• Session-management 3
• Session-management 4
• Session-management 5
• Session-management 6
• Session-management 7
• Session-management 8
• Session-management 9
• Session-management Q
• Session-management K
• Session-management A

View source on GitHub

Loading comments 0%