v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: MEDIUM auth.java.session.fixation-disabled

Spring Security session fixation protection is disabled via sessionFixation().none().

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

With none(), the session ID is NOT regenerated when a user authenticates, so an attacker who fixes the victim's session ID before login (e.g. by planting a cookie) keeps a valid session and hijacks the authenticated account (CWE-384).

Leave the default (changeSessionId) in place, or use migrateSession() to copy the existing session attributes into a new session ID. Never use none().

VULNERABLE
vulnerable.java
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

class SecurityConfig {

    SecurityFilterChain legacy(HttpSecurity http) throws Exception {
        // ruleid: auth.java.session.fixation-disabled
        http.sessionManagement().sessionFixation().none();
        return http.build();
    }

    SecurityFilterChain lambda(HttpSecurity http) throws Exception {
        // ruleid: auth.java.session.fixation-disabled
        http.sessionManagement(session -> session.sessionFixation(fixation -> fixation.none()));
        return http.build();
    }
}
SAFE
safe.java
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

class SecurityConfigSafe {

    // ok: auth.java.session.fixation-disabled -- session ID regenerated on login
    SecurityFilterChain changeId(HttpSecurity http) throws Exception {
        http.sessionManagement(session -> session.sessionFixation(fixation -> fixation.changeSessionId()));
        return http.build();
    }

    // ok: auth.java.session.fixation-disabled -- attributes migrated to a new session
    SecurityFilterChain migrate(HttpSecurity http) throws Exception {
        http.sessionManagement().sessionFixation().migrateSession();
        return http.build();
    }

    // ok: auth.java.session.fixation-disabled -- no session fixation config (default applies)
    SecurityFilterChain defaults(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated());
        return http.build();
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.java.session.fixation-disabled -- <reason>

References

https://docs.spring.io/spring-security/reference/servlet/authentication/session-management.html ↗https://cwe.mitre.org/data/definitions/384.html ↗