8 lines
819 B
Plaintext
8 lines
819 B
Plaintext
|
Session fixation attacks take advantage of the way web applications manage session identifiers. Here's how a session fixation attack typically works:
|
||
|
|
|
||
|
|
* When a user visits a website or logs in, a session is created for them.
|
||
|
|
* This session is assigned a unique session identifier, stored in a cookie, in local storage, or through URL parameters.
|
||
|
|
* In a session fixation attack, an attacker tricks a user into using a predetermined session identifier controlled by the attacker. For example, the attacker sends the victim an email containing a link with this predetermined session identifier.
|
||
|
|
* When the victim clicks on the link, the web application does not create a new session identifier but uses this identifier known to the attacker.
|
||
|
|
* At this point, the attacker can hijack and impersonate the victim's session.
|