Mitigating session fixation attacks
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 112
- Forks
- 38
- Avg merge
- 12d 19h
- Merged PRs (30d)
- 4
Description
Taking into account a quote from the specification from the 14.2 Session fixation section:
To perform a Session Fixation attack, an attacker would start the process using a Verifier executed on a device under his control, capture the Authorization Request and relay it to the device of a victim.
An attacker has, for example, the ability to fake a verifier with a website that forwards QR codes and deeplinks to victims. The preconditions for such an attack is that the authorization link displaying the QR code is an open request that is accessible without further control.
The specification also states:
It is RECOMMENDED for the Verifiers to implement mechanisms to strengthen the security of the flow.
What would be the best mitigation an implementer should set up to address the issue?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with section 14.2 of the linked OpenID4VP specification and review the described verifier-to-victim flow. Determine what mitigation guidance implementers need and document a specific, agreed recommendation for addressing the open authorization request condition.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100