# Understanding session fixation attacks

**URL:** <https://www.ruby-forum.com/t/understanding-session-fixation-attacks/54314>\
**Category:** Rails\
**Created:** [December 25, 2005, 12:33pm UTC](https://www.ruby-forum.com/t/understanding-session-fixation-attacks/54314 "2005-12-25T12:33:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Onur\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/e79b87/32.png) [@Onur\_T](https://www.ruby-forum.com/u/Onur_T)\
**Post date:** [December 25, 2005, 12:33pm UTC](https://www.ruby-forum.com/t/understanding-session-fixation-attacks/54314/1 "2005-12-25T12:33:14Z")

</div>

is there a way that, our application can understand wheteher the session  
id  
sent from the browser is forged or created by rails? I understand that  
if  
the attacker guesses session id, theres nothing we can do about it; but  
can  
we understand if he/she is trying to guess by creating random session  
ids.

---

<div class="post-metadata">

**Author:** ![Onur\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/e79b87/32.png) [@Onur\_T](https://www.ruby-forum.com/u/Onur_T)\
**Post date:** [December 25, 2005, 8:07pm UTC](https://www.ruby-forum.com/t/understanding-session-fixation-attacks/54314/2 "2005-12-25T20:07:23Z")

</div>

Can’t we just pass another unique key as a pair to validate the  
session? It’d be much harder to randomly guess two matching keys.  
That would be my simple solution.

* * *

Jim J.  
“A trustworthy individual.”  
[www.DontTrustThisGuy.com](http://www.DontTrustThisGuy.com)  
(480) 235-5201

---

<div class="post-metadata">

**Author:** ![Onur\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/e79b87/32.png) [@Onur\_T](https://www.ruby-forum.com/u/Onur_T)\
**Post date:** [December 25, 2005, 8:52pm UTC](https://www.ruby-forum.com/t/understanding-session-fixation-attacks/54314/3 "2005-12-25T20:52:28Z")

</div>

Jim J. wrote:

> Can’t we just pass another unique key as a pair to validate the  
> session? It’d be much harder to randomly guess two matching keys.  
> That would be my simple solution.

In principle there is no difference between one key and two keys, using  
two keys is the same as doubling the key length. But this is not  
necessary, the chance that someone can guess the 64 bits of the Rails  
session ID is virtually zero.

---

<div class="post-metadata">

**Author:** ![Onur\_T](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/o/e79b87/32.png) [@Onur\_T](https://www.ruby-forum.com/u/Onur_T)\
**Post date:** [December 26, 2005, 6:23am UTC](https://www.ruby-forum.com/t/understanding-session-fixation-attacks/54314/4 "2005-12-26T06:23:22Z")

</div>

How about keep the session id in the session itself. Then compare with  
what  
ever the browser send back. This way, we can verify it. However, I don’t  
know it actually works. Never try.

Tom