CVE-2009-10007

@@ -1,5 +1,6 @@
 Revision history for Perl extension Catalyst::Plugin::Authentication
 
+0.10_027 - 2026-06-07
     - When used with Catalyst::Plugin::Session, rotate the session id after a
       successful login to avoid session fixation attacks (CVE-2009-10007).
 

@@ -26,6 +26,14 @@ sub new {
         }
     }
 
+    if (!exists($self->config->{'rotate_session_id'})) {
+        if (exists($app->config->{'Plugin::Authentication'}{'rotate_session_id'})) {
+            $self->config->{'rotate_session_id'} = $app->config->{'Plugin::Authentication'}{'rotate_session_id'};
+        } else {
+            $self->config->{'rotate_session_id'} = 1;
+        }
+    }
+
     $app->log->debug("Setting up auth realm $realmname") if $app->debug;
 
     $self->setup_store($app);
@@ -238,6 +246,13 @@ sub persist_user {
         and $self->config->{'use_session'}
         and $user->supports("session")
     ) {
+        if (
+            $self->config->{rotate_session_id}
+            and $c->session_is_valid
+        ) {
+            $c->change_session_id;
+        }
+
         $c->session->{__user_realm} = $self->name;
 
         # we want to ask the store for a user prepared for the session.

@@ -814,6 +814,12 @@ prevent accidental session creation, check if a session already exists with
 if ($c->sessionid) { ... }. If the session doesn't exist, then don't place
 anything in the session to prevent an unecessary session from being created.
 
+=item rotate_session_id
+
+Whether or not to rotate the session ID when authenticating as a new user. This
+mitigates session-fixation attacks (L<CWE-384|https://cwe.mitre.org/data/definitions/384.html>).
+This requires L<Catalyst::Plugin::Session> version 0.25. This value is set to true by default.
+
 =item default_realm
 
 This defines which realm should be used as when no realm is provided to methods

@@ -34,7 +34,7 @@ my %META = (
         'Test::Pod::Coverage' => '1.04',
         'Test::NoTabs' => 0,
         'Test::EOL' => 0,
-        'Catalyst::Plugin::Session' => '0.10',
+        'Catalyst::Plugin::Session' => '0.25',
         'Catalyst::Plugin::Session::State::Cookie' => 0,
         'Digest::SHA' => 0,
       },

@@ -72,5 +72,18 @@ sub butterfly : Local {
     ok( !$c->user, "no user object either" );
 }
 
-1;
+sub octopus : Local {
+    my ( $self, $c ) = @_;
+
+    my $session_id = $c->sessionid;
+    ok($session_id, "have session id");
+    ok(!$c->user_exists, "no user exists");
+    ok(!$c->user, "no user yet");
+    ok($c->login( "bar", "s3cr3t" ), "can login with clear");
+    is( $c->user, $AuthSessionTestApp::users->{bar}, "user object is in proper place");
+    my $new_session_id = $c->sessionid;
+    ok($new_session_id, "have session id");
+    isnt($new_session_id, $session_id, "session id has changed");
+}
 
+1;

@@ -39,7 +39,7 @@ ok +$res->is_success, 'get ok';
 $res = _request('/yak');
 ok !$res->is_success, 'Not ok, user unable to be resotred == nasal demons';
 
-foreach my $type (qw/ goat fluffy_bunny possum butterfly /) {
+foreach my $type (qw/ goat fluffy_bunny possum butterfly octopus/) {
     $res = _request("/$type");
     ok +$res->is_success, "get $type ok";
 }