Function Test_Session_ExtractorPreservation

middleware/session/session_test.go:710–808

Test_Session_ExtractorPreservation verifies that the extractor which actually supplied the incoming session ID drives the write-back decision, preventing a session ID read from a read-only source (query/form/param) from being promoted into cookies/headers for an existing session (session fixation).

(t *testing.T)

// a session ID read from a read-only source (query/form/param) from being
// promoted into cookies/headers for an existing session (session fixation).
func Test_Session_ExtractorPreservation(t *testing.T) {
	t.Parallel()

	t.Run("read-only winner is not promoted for existing session", func(t *testing.T) {
		t.Parallel()
		// Chain prefers the cookie, but also accepts a read-only query source.
		store := NewStore(Config{
			Extractor: extractors.Chain(extractors.FromCookie("session_id"), extractors.FromQuery("session_id")),
		})
		app := fiber.New()

		// First request: create and persist a session (written to the cookie).
		ctx1 := app.AcquireCtx(&fasthttp.RequestCtx{})
		sess, err := store.Get(ctx1)
		require.NoError(t, err)
		sess.Set("name", "john")
		require.NoError(t, sess.Save())
		id := sess.ID()
		require.NotNil(t, ctx1.Response().Header.PeekCookie("session_id"))
		sess.Release()
		app.ReleaseCtx(ctx1)

		// Second request: the existing ID is provided only via the query string
		// (an attacker-controllable, read-only source).
		ctx2 := app.AcquireCtx(&fasthttp.RequestCtx{})
		defer app.ReleaseCtx(ctx2)
		ctx2.Request().SetRequestURI("/path?session_id=" + id)

		sess2, err := store.Get(ctx2)
		require.NoError(t, err)
		require.False(t, sess2.Fresh(), "existing session must not be fresh")
		require.Equal(t, id, sess2.ID())
		require.NoError(t, sess2.Save())

		// The read-only ID must NOT be promoted into a cookie/header.
		require.Nil(t, ctx2.Response().Header.PeekCookie("session_id"))
		require.Empty(t, string(ctx2.Response().Header.Peek("session_id")))
		sess2.Release()
	})

	t.Run("fresh session still persists to writable sink", func(t *testing.T) {
		t.Parallel()
		store := NewStore(Config{
			Extractor: extractors.Chain(extractors.FromCookie("session_id"), extractors.FromQuery("session_id")),
		})
		app := fiber.New()

		// The query supplies an ID that does not exist in storage, so a fresh
		// session with a freshly generated ID is created.
		ctx := app.AcquireCtx(&fasthttp.RequestCtx{})
		defer app.ReleaseCtx(ctx)
		ctx.Request().SetRequestURI("/path?session_id=does-not-exist")

		sess, err := store.Get(ctx)
		require.NoError(t, err)
		require.True(t, sess.Fresh(), "missing data must yield a fresh session")
		require.NotEqual(t, "does-not-exist", sess.ID(), "fresh session must use a generated ID")
		require.NoError(t, sess.Save())