Spring Security - Third Edition

Understanding session fixation attacks

Session fixation is a type of attack whereby a malicious user attempts to steal the session of an unauthenticated user of your system. This can be done by using a variety of techniques that result in the attacker obtaining the unique session identifier of the user (for example, JSESSIONID). If the attacker creates a cookie or a URL parameter with the user's JSESSIONID identifier in it, they can access the user's session.

Although this is obviously a problem, typically, if a user is unauthenticated, they haven't entered any sensitive information. This becomes a more critical problem if the same session identifier continues to be used after a user has been authenticated. If the same identifier is used ...