공격자가 제어하는 쿠키 키 또는 세션 식별자

from fastapi import FastAPI, Request
from starlette.responses import Response

app = FastAPI()


@app.get("/set-session")
async def set_session(request: Request):
    response = Response("ok")
    response.set_cookie(
        key="session",
        value=request.query_params["sid"],  # 취약: 공격자가 아는 세션 값
        secure=True,
        httponly=True,
        samesite="lax",
    )
    return response

from django.contrib.auth import authenticate, login
from django.http import HttpResponse


def sign_in(request):
    user = authenticate(
        request,
        username=request.POST["username"],
        password=request.POST["password"],
    )
    if user is None:
        return HttpResponse(status=401)

    login(request, user)  # Django가 세션 키를 회전하거나 안전하게 교체
    return HttpResponse(status=204)

import os

from flask import Flask, abort, request, session

app = Flask(__name__)
app.config.from_mapping(
    SECRET_KEY=os.environ["FLASK_SECRET_KEY"],
    SESSION_COOKIE_SECURE=True,
    SESSION_COOKIE_HTTPONLY=True,
    SESSION_COOKIE_SAMESITE="Lax",
)


@app.post("/login")
def sign_in():
    user = verify_credentials(
        request.form["username"],
        request.form["password"],
    )
    if user is None:
        abort(401)

    session.clear()  # 인증 전 상태를 제거
    session["user_id"] = user.id
    return {"status": "ok"}

from flask import Flask, make_response, request

app = Flask(__name__)


@app.get("/set-cookie")
def set_cookie():
    response = make_response("ok")
    response.set_cookie(request.args["name"], "1")  # 취약: 동적 쿠키 키
    return response

from django.http import HttpResponse


def set_raw_cookie(request):
    response = HttpResponse("ok")
    response.headers["Set-Cookie"] = request.GET["raw"]  # 취약: 원시 헤더 전체
    return response

from flask import make_response, request
from werkzeug.http import dump_cookie


def unsafe_cookie_defaults():
    names = {"theme": "theme", "locale": "locale"}
    response = make_response("ok")
    name = names.get("unknown", request.args["name"])
    response.set_cookie(name, "light")  # 취약: 기본값은 상수 매핑 밖의 요청 값
    response.headers["Set-Cookie"] = dump_cookie(
        "__Host-session", request.args["sid"], secure=True, path="/"
    )  # 취약: 직렬화해도 세션 식별자는 공격자가 선택
    return response

from fastapi import HTTPException, Request
from starlette.responses import Response


async def save_theme(request: Request):
    theme = request.query_params.get("theme", "light")
    if theme not in {"light", "dark"}:
        raise HTTPException(status_code=400)

    response = Response("saved")
    response.set_cookie(
        key="theme",
        value=theme,
        secure=True,
        samesite="lax",
    )
    return response

from flask import make_response, request
from werkzeug.http import dump_cookie


def save_preference():
    names = {"theme": "theme", "locale": "locale"}
    name = names.get(request.args["kind"], "theme")
    response = make_response("ok")
    response.set_cookie(name, "light")
    response.headers["Set-Cookie"] = dump_cookie("locale", request.args["locale"])
    return response