[FIXED] When Regenerate Session ID Laravel?

Issue

I'm building an application with login and I have read about regenerating the Session ID, using $request->session()->regenerate(); but I didn't understand where should I use this, can someone explain me when and where should I regenerate the Session ID?

Solution

If you see Default authentication then you can see for every login authentication they are regenerating session.

protected function sendLoginResponse(Request $request)
    {
        $request->session()->regenerate();

        $this->clearLoginAttempts($request);

        if ($response = $this->authenticated($request, $this->guard()->user())) {
            return $response;
        }

        return $request->wantsJson()
                    ? new JsonResponse([], 204)
                    : redirect()->intended($this->redirectPath());
    }

The main aim is to regenerating the session ID is often done in order to prevent malicious users from exploiting a session fixation attack on your application.

What is Session fixation?

Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack explores a limitation in the way the web application manages the session ID, more specifically the vulnerable web application. When authenticating a user, it doesn’t assign a new session ID, making it possible to use an existent session ID. The attack consists of obtaining a valid session ID (e.g. by connecting to the application), inducing a user to authenticate himself with that session ID, and then hijacking the user-validated session by the knowledge of the used session ID. The attacker has to provide a legitimate Web application session ID and try to make the victim’s browser use it.

As per documentation

Regenerating the session ID is often done in order to prevent malicious users from exploiting a session fixation attack on your application.

Laravel automatically regenerates the session ID during authentication if you are using one of the Laravel application starter kits or Laravel Fortify; however, if you need to manually regenerate the session ID, you may use the regenerate method:

$request->session()->regenerate(); If you need to regenerate the session ID and remove all data from the session in a single statement, you may use the invalidate method:

$request->session()->invalidate();

Ref:https://laravel.com/docs/8.x/session

Ref:https://owasp.org/www-community/attacks/Session_fixation

Answered By - John Lobo

Answer Checked By - Timothy Miller (PHPFixing Admin)