From 3a762c2f7da0be902ba358b11279ca43bef6c611 Mon Sep 17 00:00:00 2001 From: John Smith Date: Sat, 25 Jul 2026 19:10:33 -0400 Subject: [PATCH] fix(server): prevent session fixation by always issuing new signin token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit session/index.ts:73 reused getSessionToken(h3) ?? createSessionCookie(...) — pre-set cookies persisted across signin. Now always calls createSessionCookie and invalidates old session via removeSession. Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus --- server/server/internal/session/index.ts | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/server/server/internal/session/index.ts b/server/server/internal/session/index.ts index 99f1f877..bef07810 100644 --- a/server/server/internal/session/index.ts +++ b/server/server/internal/session/index.ts @@ -70,8 +70,13 @@ export class SessionHandler { const expiresAt = this.createExipreAt(rememberMe); - const token = - this.getSessionToken(h3) ?? this.createSessionCookie(h3, expiresAt); + // Invalidate any pre-existing session token — prevents session fixation + const oldToken = this.getSessionToken(h3); + const token = this.createSessionCookie(h3, expiresAt); + if (oldToken) { + await this.sessionProvider.removeSession(oldToken); + } + const defaultSession: Session = { expiresAt, data,