Multiple choice technology security

Authenticating a user without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

  1. Phishing

  2. Injection flaws

  3. Session Fixation

  4. Http Response splitting attack
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

Session Fixation attacks occur when an attacker sets a user's session ID before authentication, then uses that known session after the user logs in. Phishing and injection are different attack vectors.

AI explanation

Session fixation happens when an application lets a user authenticate while keeping the same session identifier that existed before login, allowing an attacker who set or knows that ID beforehand to hijack the now-authenticated session. The fix is to always regenerate the session ID on login. Phishing and injection flaws involve tricking users or manipulating backend queries, not reusing a pre-existing session token, and HTTP response splitting is about injecting headers into responses.

Keep practicing — related questions