From my understanding if i am not wrong in session fixation attacks. The attacker login into the server as a legitimate user and creates a valid session. He then the tricks the compromised user to use his session which has already been fixed. My Question is how to detect session fixation attacks one possible solution I have in my mind
- Bind session identifier with source IP as this is possible with WAF like Modsecurity
The Problem with this approach it may have high false positive as client may be using a proxy server or client may be assigned a dynamic IP address that may change during session.