CODEWITHSUNDEEP
springsecurityspring-securitysession-cookiessession-fixation
victordobry
victordobry

Reputation: 3408

Can HttpOnly flag prevent session fixation attack?

I have a need to preserve session id after login. My session id cookie is marked as HttpOnly. Is such setup absolutely secure? Is there any possibility for an attacker to to perform session fixation attack if my session cookie is HttpOnly?

Upvotes: 2

Views: 1721

Answers (2)

Silver
Silver

Reputation: 1095

TLDR: Yes, in PHP and Firefox it is possible to add a second session cookie which, due to the order in the header, is preferred over the original one. Also Yes, if there is other functionality which allows to set session IDs on the server. This depends on the application specific functionality.

Full explanation

Depends on what other functionality you have on your website to manipulate sessions. In some rare occasions, the application allows a user to set a session via a HTTP request. For example, via a GET parameter.

I believe you want to know if it is possible to fixate a session ID if the original session ID is set in a cookie with the HttpOnly flag. Therefore, I did a small test on a PHP application I was conducting a pentest on. Surprisingly, you can set a new PHPSESSID via a JavaScript injected as XSS. If there already was an existing PHPSESSID cookie with the HttpOnly flag, it simply puts this one next to the other one. In my case, in Firefox, it sent the following Cookies to the server after my attempt to set PHPSESSID via document.cookie = "PHPSESSID=FIXATEDSESSIONID":

Cookie: PHPSESSID=FIXATEDSESSIONID; __utma=139474299.465096418.1547461023.1548839033.1548851774.5; __utmz=139474299.1547461023.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); acceptCookies=true;

So there are now two session IDs in the request. In my setup, with PHP 5.6.25, the server takes the first cookie to bind a session. So in the case with Firefox and PHP 5.6.25, I was able to fixate my session ID (FIXATEDSESSIONID) via a JavaScript. The original session ID is still in the request but it is ignored by the server. Note that FIXATEDSESSIONID is literally the session ID I injected. So it was not necessary to get a legitimate session ID from the PHP server.

Upvotes: 1

berserkk
berserkk

Reputation: 1007

It's better to have session cookie as HttpOnly, because it obviously makes session more secure.

The right way to avoid session fixation vulnerability is to make new session for user on authentication.

Check OWASP article about session fixation. It has information about techniques to execute this kind of attack.

Upvotes: 0

Related Questions