1

I have a PHP application, where two session IDs are being used.

I will use foo and bar as example for those session IDs.

  • The foo session ID is being generated at the login page.
  • The bar session ID is being generated after a successful login.

The foo session ID is fixed, meaning it's not changing before and after a successful login. The bar session ID changes after every login and logout. The session is deleted after logging out.

If any of the session IDs (either foo or bar) is deleted from the browser, the application redirects the user to the login page.

Is this application vulnerable to session fixation or not?

Improve this question
3
  • 2
    Why are you using two session id's and which session ID is privileged? – yeah_well May 10 '19 at 9:14
  • Because one SESSION ID is being generated by CMS itself and second SESSION ID is being added by myself (let's assume a CSRF cookie) – Chetan Soni May 10 '19 at 9:58
  • What is both session ID's being used for? – yeah_well May 10 '19 at 10:02
1

If your CMS is creating the session, don't create another one. If you use session_start() somewhere on your custom code, you will use the same session your CMS created.

Don't create another another wheel to replace the professional wheel you already have.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.