What is 'session fixation' in SAP BC-SEC - Security?

session fixation - Overview

• Component: BC-SEC

• Component Name: Security

• Description: A type of attack where one user attempts to set the session ID of another user.

session fixation - Details

• 
  Key Concepts: 
  Session fixation is a security vulnerability in SAP systems that allows an attacker to hijack a user's session. It occurs when an attacker is able to set the session ID of a user's session, allowing them to gain access to the user's account without needing to authenticate. 
  
  How to use it: 
  To prevent session fixation, SAP systems should be configured to use secure session IDs that are randomly generated and not easily guessed. Additionally, the system should be configured to expire sessions after a certain amount of time and require users to re-authenticate if they have been inactive for too long. 
  
  Tips & Tricks: 
  It is important to ensure that all users are using secure passwords and that the system is configured to require users to change their passwords regularly. Additionally, it is important to ensure that all users are logging out of their accounts when they are finished using the system. 
  
  Related Information: 
  For more information on session fixation and other security vulnerabilities in SAP systems, please refer to the SAP Security Guide (https://help.sap.com/doc/saphelp_nw73/7.31.10/en-US/f3/f3b8d9a2e4d04a8e9f7c2b6c9f5d6a/content.htm).