Session Fixation in Echo Go with Bearer Tokens

Session fixation in the Echo Go framework when using Bearer Tokens occurs when an application accepts a token provided by the client instead of issuing a new one after authentication. This mismatch between token lifecycle and session establishment allows an attacker to force a known token onto a victim, then hijack the authenticated session once the victim uses it.

In Echo Go, a common pattern is to read an Authorization header like Bearer <token> and use the token value directly for authorization checks without rotating or reissuing it. Because Bearer Tokens are often long-lived or reused across requests, treating them as session identifiers without server-side invalidation or reassignment creates a fixation surface. An attacker can craft a link such as https://api.example.com/resource?token=ATTACKER_TOKEN or set a cookie/header before authentication, knowing the victim will authenticate with the same token.

The vulnerability is amplified when the API relies solely on the Bearer Token for identity and does not bind it to a per-session context, such as a server-side session store or a cryptographically random session ID. Echo Go middleware that only validates the token signature and scopes but does not enforce token regeneration post-login enables the attacker to reuse the authenticated token to access victim-controlled resources, leading to unauthorized access to protected endpoints.

Real-world parallels exist in APIs where OAuth 2.0 access tokens are treated as session identifiers without additional binding. For example, if an API endpoint uses a static token issued to one client and that token is leaked via logs, browser history, or referrer headers, any party possessing the token can impersonate the user until expiration or revocation. This aligns with the broader OWASP API Security Top 10 category on Broken Object Level Authorization (BOLA), where object references like tokens are not properly validated per request context.

To detect this pattern, scanners can analyze whether authentication endpoints issue new tokens after login and whether token usage is tied to a per-request or per-session context. APIs that accept client-supplied Bearer Tokens for authentication without rotation or additional binding mechanisms should be flagged for review.

Remediation focuses on ensuring that after successful authentication, the server does not simply adopt a client-provided Bearer Token as the session identifier. Instead, the server should issue its own session-bound token or enforce strict token binding and rotation. Below are concrete examples for Echo Go.

Bad practice — using a client-supplied token directly:

import (
    "net/http"
    "github.com/labstack/echo/v4"
)

func Login(c echo.Context) error {
    var req struct {
        Token string `json:"token"`
    }
    if err := c.Bind(&req); err != nil {
        return err
    }
    // Vulnerable: using client-supplied token as session token
    return c.JSON(http.StatusOK, echo.Map{
        "token": req.Token,
    })
}

Good practice — issue a server-managed token after authentication:

import (
    "crypto/rand"
    "encoding/base64"
    "net/http"
    "github.com/labstack/echo/v4"
)

func generateToken() (string, error) {
    buf := make([]byte, 32)
    _, err := rand.Read(buf)
    if err != nil {
        return "", err
    }
    return base64.URLEncoding.EncodeToString(buf), nil
}

func Login(c echo.Context) error {
    var req struct {
        Username string `json:"username"`
        Password string `json:"password"`
    }
    if err := c.Bind(&req); err != nil {
        return err
    }
    // Validate credentials (pseudo)
    if !isValidUser(req.Username, req.Password) {
        return echo.ErrUnauthorized
    }
    sessionToken, err := generateToken()
    if err != nil {
        return err
    }
    // Store sessionToken server-side, associate with user
    return c.JSON(http.StatusOK, echo.Map{
        "token": sessionToken,
    })
}

When validating incoming Bearer Tokens, ensure they are treated as opaque references verified server-side rather than trusted identifiers assigned by the client. Middleware should validate token signatures, scopes, and expiration, and reject tokens that were not issued by the server after authentication.

For APIs that integrate with OAuth 2.0 providers, do not accept an access_token from the client as a session key. Instead, use the provider’s introspection endpoint or validate the JWT securely on the server, and map the result to an internal session identifier that is rotated on privilege changes or re-authentication.