Fixation protection

Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack explores a limitation in the way the web application manages the session ID, more specifically the vulnerable web application. When authenticating a user, it doesn't assign a new session ID, making it possible to use an existent session ID.

The OWASP® Foundation, Cross Site Request Forgery (CSRF)(opens in a new tab)

Session fixation is a technique for hijacking a user session.

Consider an attacker visits a public computer, navigates to example.com and starts the sign in process, but does not finish signing in. Before leaving the computer, the attacker inspects the session token and takes it with them.

Then, consider a victim sits at the same computer, navigates to example.com, and signs in with their own account.If example.com failed to reset the session token for the victim, then the attacker can hijack the victim's session and act on their behalf.

How does Clerk protect against session fixation?

Clerk resets the session token each time a user signs in or out of a browser. When the session is reset, the old session token is invalidated and can no longer be used for authentication.

Last updated on January 8, 2024