Session Fixation

// servlet/LoginServlet.java
import javax.servlet.http.*;

public class LoginServlet extends HttpServlet {
    protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
        String user = request.getParameter("username");
        String pass = request.getParameter("password");
        // Assume authenticateUser(user, pass) returns a User object or null

        if (authenticateUser(user, pass) != null) {
            // DANGEROUS: Gets existing session (potentially set by attacker)
            // and just adds attributes. Does not invalidate old ID.
            HttpSession session = request.getSession(); // Might return existing session
            session.setAttribute("userPrincipal", user);
            response.sendRedirect("/dashboard");
        } else {
            // Handle login failure
            response.sendRedirect("/login?error=1");
        }
    }
}

// config/SecurityConfig.java
@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        // ... authorizeRequests, formLogin ...
        .sessionManagement()
            // DANGEROUS: Disables session migration after login.
            .sessionFixation().none(); // Options: none, newSession, migrateSession (default)
}

// config/SecurityConfig.java (Secure Spring Security Default)
@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        // ... authorizeRequests, formLogin ...
        .sessionManagement()
            // SECURE: Use default (migrateSession) or explicitly set newSession.
            .sessionFixation().migrateSession(); // Or .newSession()
}

// servlet/LoginServlet.java (Secure Manual Session Handling)
protected void doPost(HttpServletRequest request, HttpServletResponse response)
            throws ServletException, IOException {
    String user = request.getParameter("username");
    String pass = request.getParameter("password");

    if (authenticateUser(user, pass) != null) {
        // SECURE: Invalidate previous session (if any)
        HttpSession oldSession = request.getSession(false);
        if (oldSession != null) {
            oldSession.invalidate();
        }
        // SECURE: Create a brand new session after successful login
        HttpSession newSession = request.getSession(true); // Creates new session
        newSession.setAttribute("userPrincipal", user);
        response.sendRedirect("/dashboard");
    } else {
        response.sendRedirect("/login?error=1");
    }
}

// Controllers/AccountController.cs (Custom Auth Example)
public IActionResult ManualLogin(string username, string password)
{
    var user = ValidateCredentialsManually(username, password); // Assume returns user object
    if (user != null)
    {
        // DANGEROUS: Directly setting session variables without regenerating session ID.
        // Attacker could fixate the session ID before this point.
        HttpContext.Session.SetString("UserId", user.Id.ToString());
        HttpContext.Session.SetInt32("IsLoggedIn", 1);
        // Missing: HttpContext.Session.CommitAsync(); HttpContext.Session.Clear(); then set again? Complex.
        // Better: Use SignInManager or manually force new session ID if possible.
        return RedirectToAction("Index", "Home");
    }
    // Handle failure...
    return View("Login");
}

// Controllers/AccountController.cs (Secure - Using SignInManager)
public class AccountController : Controller
{
    private readonly SignInManager<IdentityUser> _signInManager; // Use actual user type
    private readonly UserManager<IdentityUser> _userManager;

    public AccountController(SignInManager<IdentityUser> signInManager, UserManager<IdentityUser> userManager) { /* ... */ }

    [HttpPost]
    public async Task<IActionResult> Login(LoginViewModel model)
    {
        if (ModelState.IsValid)
        {
            var user = await _userManager.FindByEmailAsync(model.Email);
            if (user != null) {
                 // SECURE: PasswordSignInAsync handles secure comparison AND
                 // manages the authentication cookie/session securely, preventing fixation.
                var result = await _signInManager.PasswordSignInAsync(user, model.Password, model.RememberMe, lockoutOnFailure: true);
                if (result.Succeeded)
                {
                    return RedirectToAction("Index", "Home");
                }
                // ... handle lockout, MFA, failure ...
            }
            ModelState.AddModelError(string.Empty, "Invalid login attempt.");
        }
        return View(model);
    }
}

<?php
// login.php (Plain PHP)
session_start(); // Starts session, potentially using attacker-provided ID
$username = $_POST['username'];
$password = $_POST['password'];
$stored_hash = get_password_hash($username); // Assume function exists

if ($stored_hash && password_verify($password, $stored_hash)) {
    // DANGEROUS: User is logged in, but the session ID is not regenerated.
    // Attacker who fixated the ID before login now has access.
    $_SESSION['user_id'] = get_user_id($username);
    $_SESSION['logged_in'] = true;
    header('Location: /dashboard.php');
    exit;
} else {
    header('Location: /login.php?error=1');
    exit;
}
?>

// app/Http/Controllers/CustomLoginController.php
public function login(Request $request) {
    // ... validate credentials ...
    $user = User::where('email', $request->email)->first();
    if ($user && Hash::check($request->password, $user->password)) {
        // DANGEROUS: Manually setting session without regenerating ID.
        $request->session()->put('user_id', $user->id);
        // Missing: $request->session()->regenerate();
        return redirect('/dashboard');
    }
    return back()->withErrors(['email' => 'Login failed']);
}

<?php
// login_secure.php (Plain PHP)
session_start();
$username = $_POST['username'] ?? '';
$password = $_POST['password'] ?? '';
$stored_hash = get_password_hash($username);

if ($stored_hash && password_verify($password, $stored_hash)) {
    // SECURE: Regenerate session ID, delete old session data.
    session_regenerate_id(true);
    $_SESSION['user_id'] = get_user_id($username);
    $_SESSION['logged_in'] = true;
    header('Location: /dashboard.php');
    exit;
} else {
    // ... handle failure ...
}
?>

// app/Http/Controllers/Auth/LoginController.php (Laravel Default - Secure)
use Illuminate\Foundation\Auth\AuthenticatesUsers;
// ...
class LoginController extends Controller {
    use AuthenticatesUsers; // Includes secure login attempt handling
    // ...
    // AuthenticatesUsers trait calls $request->session()->regenerate()
    // in the authenticated() method or sendLoginResponse().
}
// OR if using manual login:
public function secureManualLogin(Request $request) {
   // ... validate, check credentials ...
   if ($validCredentials) {
        Auth::login($user); // Log the user in
        // SECURE: Manually regenerate session ID
        $request->session()->regenerate();
        return redirect()->intended('dashboard');
   }
   // ...
}

// routes/auth.js - Assume express-session middleware is used
// Assume User model, bcrypt, ensureLoggedOut middleware exist
router.post('/login', ensureLoggedOut, async (req, res) => {
    const { username, password } = req.body;
    const user = await User.findOne({ username });
    if (user && await bcrypt.compare(password, user.passwordHash)) {
        // DANGEROUS: Modifying the existing session (potentially fixated)
        // without regenerating its ID.
        req.session.userId = user._id;
        req.session.loggedIn = true;
        // Missing: req.session.regenerate(...)
        res.redirect('/dashboard');
    } else {
        res.status(401).send('Login failed');
    }
});

// routes/auth.js (Secure - Manual Regeneration)
router.post('/login-secure', ensureLoggedOut, async (req, res, next) => { // Added next for error handling
    const { username, password } = req.body;
    try {
        const user = await User.findOne({ username });
        if (user && user.passwordHash && await bcrypt.compare(password, user.passwordHash)) {
            // SECURE: Regenerate session before storing user data.
            req.session.regenerate((err) => {
                if (err) {
                    console.error("Session regeneration error:", err);
                    return next(err); // Pass error to error handler
                }
                // Store user ID etc. in the NEW session
                req.session.userId = user._id;
                req.session.loggedIn = true;
                // Save session before redirect if using certain stores
                req.session.save((saveErr) => {
                    if (saveErr) {
                        console.error("Session save error:", saveErr);
                        return next(saveErr);
                    }
                    res.redirect('/dashboard');
                });
            });
        } else {
            // Add rate limiting
            res.status(401).send('Invalid credentials');
        }
    } catch (err) {
         console.error("Login process error:", err);
         next(err); // Pass to error handler
    }
});

// Secure Example with Passport.js (Relies on internal regeneration)
// passport.authenticate('local', { successRedirect: '/dashboard', failureRedirect: '/login' })
// Verify Passport's req.login() triggers session regeneration with your express-session setup.
// Explicit regeneration within a custom callback provides certainty:
// passport.authenticate('local', (err, user, info) => {
//    if (err) { return next(err); }
//    if (!user) { return res.redirect('/login'); }
//    req.logIn(user, (loginErr) => { // req.logIn handles session setup
//       if (loginErr) { return next(loginErr); }
//       // Ensure session regeneration happens here, often req.logIn does this. Check source/docs.
//       // If needed, call req.session.regenerate() AFTER req.logIn completes.
//       return res.redirect('/dashboard');
//    });
// })(req, res, next);

# app/controllers/sessions_controller.rb
class SessionsController < ApplicationController
  def create
    user = User.find_by(email: params[:email])
    # Assume authenticate checks password correctly
    if user&.authenticate(params[:password])
      # DANGEROUS: Setting user_id in the existing session without resetting.
      # Attacker could have fixated the session ID before login.
      session[:user_id] = user.id
      # Missing: reset_session
      redirect_to root_path, notice: 'Logged in.'
    else
      flash.now[:alert] = "Invalid credentials."
      render :new, status: :unprocessable_entity
    end
  end
end

# app/controllers/sessions_controller.rb (Secure Manual Login)
class SessionsController < ApplicationController
  def create
    user = User.find_by(email: params[:email])

    if user&.authenticate(params[:password])
      # SECURE: Reset session to invalidate the old ID and create a new one.
      reset_session
      # Now store user ID in the new session.
      session[:user_id] = user.id
      redirect_to root_path, notice: 'Logged in successfully.'
    else
      flash.now[:alert] = "Invalid email or password."
      render :new, status: :unprocessable_entity
    end
  end
end

# Using Devise (Secure by Default)
# Ensure standard Devise controllers or Warden hooks are used.
# Devise's sign_in method typically handles session rotation.