Session Fixation


Session Fixation is an attack that permits an attacker to hijack a valid user session. The attacker must provide a legitimate web application session ID and try to make the victim's browser use it. The attack explores a limitation in the way the web application manages the session ID, more specifically the vulnerable web application. When authenticating a user, it doesn’t assign a new session ID, making it possible to use an existent session ID.

Session fixation attacks are designed to exploit authentication and session management flaws. The most common technique employed by attackers involves taking advantage of cross-site scripting or HTTP response splitting vulnerabilities in the target site . By tricking the victim into submitting a malicious request to a vulnerable application that reflects JavaScript or other code back to the victim's browser, an attacker can create a cookie that will cause the victim to reuse a session identifier controlled by the attacker.

Research
The State Of Web Application And API Protection

The State Of Web Application And API Protection

This report uses survey data to examine organizations’ application and API security awareness, visibility, best practices and security strategies and looks at how different roles within a company view app security.

Read more

Contact Radware Sales

Our experts will answer your questions, assess your needs, and help you understand which products are best for your business.

Already a Customer?

We’re ready to help, whether you need support, additional services, or answers to your questions about our products and solutions.

Locations
Get Answers Now from KnowledgeBase
Get Free Online Product Training
Engage with Radware Technical Support

Get Social

Connect with experts and join the conversation about Radware technologies.

Radware Blog
Security Research Center