sc-session

SC: Session Management Flaws

Purpose

Detects session management vulnerabilities including session fixation, predictable session tokens, insecure cookie attributes, missing session regeneration on privilege change, excessive session timeouts, and improper session invalidation. Covers cookie-based sessions, server-side sessions, and token-based session patterns.

Activation

Called by sc-orchestrator during Phase 2 when session management is detected.

Phase 1: Discovery

Keyword Patterns to Search

"session", "cookie", "Set-Cookie", "httpOnly", "secure", "SameSite",
"session_start", "session_regenerate_id", "req.session",
"SESSION_COOKIE", "CSRF_COOKIE", "express-session", "cookie-session",
"maxAge", "expires", "session.save(", "session.destroy(",
"SessionCreationPolicy"

Vulnerability Patterns

1. Missing Cookie Security Attributes:

// VULNERABLE: Session cookie without security flags
app.use(session({
  secret: 'keyboard cat',
  cookie: { }  // No httpOnly, secure, or sameSite
}));

// SAFE: All security attributes set
app.use(session({
  secret: process.env.SESSION_SECRET,
  cookie: {
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
    maxAge: 3600000  // 1 hour
  },
  resave: false,
  saveUninitialized: false
}));

2. Missing Session Regeneration After Login:

# VULNERABLE: Same session ID before and after authentication
def login(request):
    user = authenticate(request.POST['username'], request.POST['password'])
    if user:
        request.session['user_id'] = user.id  # Session fixation!
        return redirect('/dashboard')

# SAFE: Regenerate session after login
def login(request):
    user = authenticate(request.POST['username'], request.POST['password'])
    if user:
        request.session.flush()  # Destroy old session
        request.session.cycle_key()  # New session ID
        request.session['user_id'] = user.id
        return redirect('/dashboard')

3. Session Not Invalidated on Logout:

// VULNERABLE: Session data cleared but session ID persists
@PostMapping("/logout")
public void logout(HttpSession session) {
    session.removeAttribute("user");
}

// SAFE: Invalidate entire session
@PostMapping("/logout")
public void logout(HttpSession session) {
    session.invalidate();
}