From http://www.acros.si/papers/session_fixation.pdf :
5.2. Preventing the attacker from obtaining a valid session ID
If possible, a web application on a strict system should only issue session IDs of newly
generated sessions to users after they have successfully authenticated (as opposed to
issuing them along with the login form). This means that an attacker who isn’t a
legitimate user of the system will not be able to get a valid session ID and will
therefore be unable to perform a session fixation attack.
Symfony up to and including 1.0.5 calls session_start() when displaying the login form, resulting in the cookie being sent before the user authenticates:
storage/sfSessionStorage.class.php
public function initialize($context, $parameters = null)
{
// ...
if ($this->getParameter('auto_start', true))
{
// start our session
session_start();
}
}
Perhaps session handling should be moved to filter/sfBasicSecurityFilter.class.php :
public function execute($filterChain)
{
// ...
if ($user->isAuthenticated())
{
// here
