Cherrypy accepts user-supplied session identifiers

[ghost]

Originally reported by: Anonymous

---

Cherrypy accepts user-supplied session identifiers. This makes session fixation attacks easier. In case session cookie contains sid that does not reference existing session the client-supplied id should be discarded and a new SID should be generated and sent to client.

Reported by pstradomski@gmail.com

---

• Bitbucket: https://bitbucket.org/cherrypy/cherrypy/issue/709

[ghost]

Original comment by guest (Bitbucket: guest, GitHub: guest):

---

Perhaps changing lib.sessions.py, around line 71 to:

self.id = id
if self.id and self._load is None:
self.id = None
while self.id is None:

would be enough, but I'm not sure.

[ghost]

Original comment by Robert Brewer (Bitbucket: fumanchu, GitHub: fumanchu):

---

Fixed in [1840].