v0.15 is out: rules that were silently dropped on the shipped engine now run, and scans skip your test and mock files by default. Read more →
HIGH AI PREVALENCE: MEDIUM auth.java.session.fixation-disabled

Spring Security session fixation protection is disabled via sessionFixation().none().

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

With none(), the session ID is NOT regenerated when a user authenticates, so an attacker who fixes the victim's session ID before login (e.g. by planting a cookie) keeps a valid session and hijacks the authenticated account (CWE-384).

Leave the default (changeSessionId) in place, or use migrateSession() to copy the existing session attributes into a new session ID. Never use none().

VULNERABLE
vulnerable.java
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

class SecurityConfig {

    SecurityFilterChain legacy(HttpSecurity http) throws Exception {
        // ruleid: auth.java.session.fixation-disabled
        http.sessionManagement().sessionFixation().none();
        return http.build();
    }

    SecurityFilterChain lambda(HttpSecurity http) throws Exception {
        // ruleid: auth.java.session.fixation-disabled
        http.sessionManagement(session -> session.sessionFixation(fixation -> fixation.none()));
        return http.build();
    }
}
SAFE
safe.java
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

class SecurityConfigSafe {

    // ok: auth.java.session.fixation-disabled -- session ID regenerated on login
    SecurityFilterChain changeId(HttpSecurity http) throws Exception {
        http.sessionManagement(session -> session.sessionFixation(fixation -> fixation.changeSessionId()));
        return http.build();
    }

    // ok: auth.java.session.fixation-disabled -- attributes migrated to a new session
    SecurityFilterChain migrate(HttpSecurity http) throws Exception {
        http.sessionManagement().sessionFixation().migrateSession();
        return http.build();
    }

    // ok: auth.java.session.fixation-disabled -- no session fixation config (default applies)
    SecurityFilterChain defaults(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated());
        return http.build();
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.java.session.fixation-disabled -- <reason>

References

https://docs.spring.io/spring-security/reference/servlet/authentication/session-management.html ↗https://cwe.mitre.org/data/definitions/384.html ↗