Session Fixation in Chi with Jwt Tokens

Session fixation in the context of Chi with JWT tokens occurs when an attacker forces a user to authenticate using a session identifier (or JWT) that the attacker knows or can predict. Because Chi applications often issue JWTs after login and may rely on cookies or URL parameters to convey the token, improper handling of token assignment and validation can allow an attacker to fixate a token on the victim’s session.

One common pattern: a Chi application sets a JWT in a cookie or as an Authorization header only after successful authentication, but before login it may accept a token provided by the client (for example via a query parameter or a custom header). If this pre-authentication token is not rejected or rotated upon login, an attacker can craft a link such as https://api.example.com/login?token=attacker_token and trick a victim into visiting it. When the victim submits credentials, the server may validate the provided token, issue additional claims, and return a JWT that incorporates the attacker-chosen token or a predictable value tied to it. The victim’s browser then stores this attacker-known JWT, and subsequent authenticated requests carry it, allowing the attacker to hijack the session.

Chi routes often rely on middleware that reads the JWT from cookies or headers and validates its signature and claims. If the application does not enforce strict token binding—such as tying the JWT to a nonce, a client-supplied value that changes at login, or a per-session random component—an attacker can reuse a fixed token across sessions. Additionally, if the token is transmitted in URLs (e.g., for OAuth redirect flows), it can leak via Referer headers or browser history, further enabling fixation. JWTs with long lifetimes or without proper rotation amplify the risk: once fixed, the token remains valid until expiration, and attackers can reuse it across requests without needing to re-authenticate.

Another vector involves misconfigured Chi endpoint behavior where token issuance does not invalidate prior tokens or session identifiers. For example, an endpoint might accept both a bearer token in the Authorization header and a cookie token, and upon login it may only update one channel while leaving the other active. This inconsistency can allow an attacker to fixate a token in the less-protected channel (such as a cookie) and then leverage it to gain authenticated access. Chi applications that integrate multiple authentication schemes must ensure consistent token lifecycle management to prevent such fixation across channels.

Real-world attack patterns mirror general session fixation, but with JWT specifics: attackers may probe endpoints that accept optional tokens, inspect responses for predictable issuers or subject values, and attempt to correlate issued JWTs with pre-authentication input. Because JWTs often contain user identifiers (sub) or scopes, a fixed token can expose authorization boundaries if the claims are not re-validated against the authenticated user post-login. The risk is compounded when applications embed sensitive data in the JWT payload without re-verifying binding attributes after authentication.

Remediation focuses on ensuring that a JWT cannot be fixed before authentication and that tokens are rotated and bound to the authenticated session. In Chi, this typically involves rejecting pre-authentication tokens, issuing a new JWT upon login, and binding the token to session-specific or user-specific context.

Example: Reject token pre-supplied via query or header before login.

open import decidable
open import http

def secureLoginRoute (req : Request) : IO Response := do
  -- Do not accept a token in query params or headers before authentication
  let tokenFromQuery ← req.getQueryParam "token"
  let tokenFromHeader ← req.getHeader "Authorization"
  if (tokenFromQuery ≠ none) || (tokenFromHeader ≠ none) then
    pure $ response400 { body := "Do not supply tokens before login" }
  else do
    creds ← parseCredentials req
    case validateCredentials creds of
    | some user =
        -- Create a fresh JWT bound to the user and a server-side nonce
        let freshToken = createJWT { sub := user.id, nonce := randomNonce (), exp := now + 1.hour }
        -- Set the token only via HttpOnly, Secure cookie or return in body for SPA
        pure $ response200
          { setCookies = [ cookie "token" freshToken { httpOnly = true, secure = true, path = "/" } ]
          , body = "{\"access_token\": \"" ++ freshToken ++ "\"}"
          }
    | none → pure $ response401 { body := "Invalid credentials" }

Example: Rotate and bind token after login, clearing any pre-authentication context.

def postLogin (req : Request) : IO Response := do
  sessionId ← generateSecureRandomId
  user ← authenticateUser req
  let claims = { sub := user.id, session_id := sessionId, scope := "api", exp := now + 30.minutes }
  let newToken = signJWT secretKey claims
  -- Ensure any existing cookie is cleared before setting a new one
  pure $ response200
    { setCookies = [
        cookie "token" newToken {
          httpOnly = true,
          secure = true,
          sameSite = Some strict,
          path = "/"
        }
      ]
    , body = "{\"token\": \"" ++ newToken ++ "\"}"
    }

Example: Validate token binding on protected endpoints by checking session identifiers or nonce claims.

def authMiddleware (req : Request) : IO (Option Response) := do
  token ← getBearerToken req <|> getCookieToken req req.cookies
  case decodeAndVerify token secretKey of
  | some payload →
      if payload.nonce ≠ storedNonceForSession payload.sub then
 pure (some $ response403 { body := "Token binding mismatch" })
      else
        -- proceed with authenticated request
        none
  | none → pure (some $ response401 { body := "Unauthorized" })

Additional guidance: Use short-lived JWTs with refresh token rotation, avoid placing tokens in URLs, and ensure all Chi endpoints consistently reject or ignore tokens supplied before authentication. Map these controls to the relevant checks in the OWASP API Security Top 10 and compliance frameworks as applicable.