Session Fixation in Chi with Firestore

Session fixation is a web session security vulnerability where an attacker sets a user’s session identifier to a known value, then tricks the user into authenticating with that identifier. In a Chi application using Google Cloud Firestore as a session store, the risk arises when session identifiers are issued before authentication and stored in Firestore without sufficient entropy or binding to the client’s authentication state.

Chi is a minimalistic routing library for Clojure web applications. When sessions are managed via Firestore, the server typically writes a session document (e.g., in a sessions collection) that maps a session ID to user data. If the session ID is predictable, issued before login, or not rotated after authentication, an attacker can fixate a session ID on a victim and later hijack the authenticated session by using the known ID.

Consider a Firestore schema where each session document contains user ID, expiry, and IP metadata. If the application assigns a session ID from an unverified cookie before authentication and then updates the Firestore document upon login without regenerating the session ID, the fixed ID becomes a direct link to the authenticated account. Because Firestore rules govern access but do not inherently prevent session fixation at the application layer, the server must explicitly rotate identifiers and validate binding between the session document and the authenticated user.

Attack patterns enabled by this setup include session hijacking via social engineering or network sniffing, where the attacker uses the known session ID to access the victim’s authenticated Firestore session document. If the Firestore client library is misconfigured or if session documents are over-permissive in rules, an attacker might also leverage SSRF or insecure client-side handling to further exploit the binding weakness.

In Chi, developers often use the ring.middleware.session library with a custom Firestore-backed store. If the store generates or accepts session IDs without ensuring they are cryptographically random and regenerated post-authentication, the unauthenticated session document becomes a vector. For example, a session document created with a static or low-entropy ID before login can be targeted by an attacker who tricks a user into visiting a link like https://app.example.com/login?session_id=known123, then authenticates, and the Firestore document updates to reflect the authenticated state under the attacker-chosen ID.

To mitigate this within the Chi + Firestore context, always generate a new, high-entropy session ID upon successful authentication and immediately update the Firestore document. Bind the session document to the authenticated user’s UID and enforce strict Firestore security rules so that only the authenticated user (and server-side handlers) can modify or read the session. Additionally, validate that the session ID in the request matches the server-side Firestore record before trusting any session-derived claims, thereby closing the fixation window.

Remediation centers on session ID regeneration, strict Firestore document scoping, and secure cookie attributes. Below are concrete, syntactically correct examples using Clojure with Chi and the Google Firestore client library.

1. Generate a cryptographically random session ID and bind it to authenticated user

After verifying credentials, create a new session ID and write a document in the sessions collection keyed by that ID. Include the user UID and server-side metadata to enforce ownership.

(ns app.auth
  (:require [cheshire.core :as json]
            [clj-http.client :as http]
            [taoensso.carmine :as car] ;; assuming use of Carmine for Redis; replace with Firestore client as needed
            [com.google.cloud.firestore :as firestore]
            [java.util :as util]
            [clojure.string :as str]))

(defn create-session [user-uid]
  (let [session-id (str/replace (java.util.UUID/randomUUID) "-" "")
        db (.getFirestore (firestore/FirestoreOptions/getDefaultInstance))
        session-doc (firestore/DocumentReference. db (str "sessions/" session-id))
        data {"user_uid" user-uid
              "created_at" (util/Date.)
              "expires_at" (doto (util/Date.)
                             (.setTime (+ (.getTime (util/Date.)) (* 3600 1000 24))))}]
    (.set session-doc data)
    session-id))

This ensures each authenticated session has a unique, unpredictable ID stored in Firestore, preventing fixation by replacing any pre-existing session identifier.

2. Chi middleware: rotate session ID on authentication

In your Chi handler pipeline, after successful login, discard the old session and issue a new Firestore-backed session. Use secure, HTTP-only cookies with SameSite and Secure flags.

(ns app.middleware
  (:require [ring.middleware.session :as session]
            [ring.middleware.session.cookie :as cookie]
            [app.auth :refer [create-session]]))

(defn wrap-session-regeneration [handler]
  (fn [request]
    (let [response (handler request)
          {:keys [user/id]} (:authenticated request)
          session (:session request)]
      (if (and id (not= id (:user-id session)))
        (let [new-id (create-session id)]
          (-> response
              (assoc :session (assoc session :id new-id))
              (cookie/set-cookie (cookie/cookie-session-store {:key "session" :signing-key "change-me"})
                                 {:name "session_id"
                                  :value new-id
                                  :http-only true
                                  :secure true
                                  :same-site :strict
                                  :max-age 86400})))
        response))))

Integrate this middleware before routing in your Chi app to ensure session IDs are rotated immediately after authentication, updating the corresponding Firestore document via create-session.

3. Firestore security rules to enforce ownership

While rules don’t prevent fixation directly, they ensure that only the authenticated user (server-side verified) can read or write their session document. Use request.auth.uid validated against the document’s user_uid field.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /sessions/{sessionId} {
      allow read, write: if request.auth != null && request.auth.uid == request.resource.data.user_uid;
    }
  }
}

4. Secure cookie handling in Chi routes

Ensure session cookies are set with properties that reduce fixation and leakage risks. In Chi, you can control cookie attributes via the session store configuration.

(def app
  (-> (routes ...)
      (session/wrap-session {:store (cookie/cookie-session-store {:key "app_sessions"
                                                                 :cookie-attrs {:http-only true
                                                                                :secure true
                                                                                :same-site "strict"
                                                                                :max-age (* 3600 24)}}})))