Q29: What are Session Hijacking and Session Fixation attacks, and how are they prevented?
- Session Hijacking: An attacker steals a legitimate user's active session ID or access token and impersonates them.
- Session Fixation: An attacker sets a known session ID in a victim's browser before login; when the victim logs in, the attacker uses the predefined session ID to access the account.
Mitigations:
- Regenerate session IDs and tokens immediately upon successful user login.
- Enforce strict HTTPS using HSTS (
Strict-Transport-Security). - Bind tokens to TLS client fingerprints or DPoP (Demonstrating Proof-of-Possession).
Key Takeaways
- Regenerate session identifiers immediately upon user privilege state changes or login.
- Enforce HTTPS across all application routes to prevent token interception.