Vulnerability Fixation
Session Vulnerabilities in Web Applications



What is session?

Session is about authenticating the communication between the user and the server. To understand this concept better see the following scenario shown in Fig

Here it's shown how the sever grants a session id/token to the user when he is logging in. Every time the user requests the server to show a new page, the user has to send the session id/token along with it.

The server validates the requested session id/token and responds to the user. So through this it can be understood that every login page has a session. But the important question is, whether it is secure Sessions can be implemented using one of these ways Session Cookies, Header parameters, HTTP body parameters, Authentication tokens, etc.

Attack

  • Attackers steal active session tokens (session replay) to impersonate users after logout or without credentials.
  • Duplicate or persistent sessions (same user logged in from multiple devices) increase attack surface and session-management complexity.
  • Long-lived or unchanged session IDs allow attackers to reuse tokens and maintain access.

Impact

  • Unauthorized access to sensitive data and user accounts.
  • Session hijacking, data theft, privacy breaches, and potential privilege escalation.
  • Increased risk of phishing and long-term undetected compromise when sessions persist.

Solution

  • Use unique, high-entropy session tokens and rotate them frequently (e.g., on login and important actions).
  • Invalidate previous sessions when a new session is created and delete sessions on logout.
  • Enforce session timeouts, limit concurrent sessions per user, and monitor/log suspicious session activity.

Also Read :