# session_prescan report

files scanned: 5 — findings: 21

## HIGH
- `SES-FIXATION` hostile/Login.php:2 — session id taken from request input — an attacker can plant a known id before the victim logs in
- `SES-HTTPONLY-OFF` hostile/app.js:10 — HttpOnly explicitly off on a cookie/session line — any injected script can read and replay the session
- `SES-FIXATION` hostile/app.js:23 — session id taken from request input — an attacker can plant a known id before the victim logs in
- `SES-HTTPONLY-OFF` hostile/php.ini:1 — HttpOnly explicitly off on a cookie/session line — any injected script can read and replay the session
- `SES-HTTPONLY-OFF` hostile/settings.py:2 — HttpOnly explicitly off on a cookie/session line — any injected script can read and replay the session
## MEDIUM
- `SES-SECRET-LIT` hostile/app.js:6 — session middleware configured with a hardcoded secret literal — forgeable signatures and repo-scoped blast radius
- `SES-SECURE-OFF` hostile/app.js:11 — Secure explicitly off on a cookie/session line — the credential travels over plain HTTP
- `SES-SAMESITE-NONE` hostile/app.js:12 — SameSite=None — the cookie rides cross-site requests; CSRF protections must live elsewhere
- `SES-URL-ID` hostile/app.js:14 — session id embedded in a URL query — ids leak through logs, analytics, and Referer headers
- `SES-TOKEN-STORAGE` hostile/app.js:18 — auth/session token written to web storage — readable by any injected script (XSS -> token theft)
- `SES-DOC-COOKIE` hostile/app.js:19 — document.cookie writes an auth/session-named cookie — script-side session state, no HttpOnly possible
- `SES-SECURE-OFF` hostile/php.ini:2 — Secure explicitly off on a cookie/session line — the credential travels over plain HTTP
- `SES-SAMESITE-NONE` hostile/php.ini:3 — SameSite=None — the cookie rides cross-site requests; CSRF protections must live elsewhere
- `SES-TRANS-SID` hostile/php.ini:4 — URL session-id transport enabled — ids leak through links, logs, analytics, and Referer headers
- `SES-TRANS-SID` hostile/php.ini:5 — URL session-id transport enabled — ids leak through links, logs, analytics, and Referer headers
- `SES-SECURE-OFF` hostile/settings.py:1 — Secure explicitly off on a cookie/session line — the credential travels over plain HTTP
- `SES-SAMESITE-NONE` hostile/settings.py:3 — SameSite=None — the cookie rides cross-site requests; CSRF protections must live elsewhere
## LOW
- `SES-LONG-LIVED` hostile/app.js:7 — cookie/session lifetime 31536000000 — >=30-day validity for a stolen credential
- `SES-WIDE-DOMAIN` hostile/app.js:13 — cookie Domain scoped to a leading-dot parent — every subdomain can read and write it
- `SES-LONG-LIVED` hostile/settings.py:4 — cookie/session lifetime 31536000 — >=30-day validity for a stolen credential
- `SES-LONG-LIVED` hostile/settings.py:5 — permanent session lifetime 365d — stolen credentials stay valid for weeks