Session Management Security: Tokens, Cookies, and Stateless Authentication Done Right

Session Security Fundamentals

Session management is how web applications maintain state for authenticated users. Poor session management enables account takeover, session hijacking, and unauthorized access.

Session Vulnerabilities

Session Fixation

Attacker sets a known session ID before the user authenticates:

1. Attacker obtains a session ID from the server
2. Attacker tricks user into using that session ID
3. User authenticates with the fixed session ID
4. Attacker uses the same session ID and is now authenticated

Prevention: Regenerate session ID after authentication.

Session Hijacking

Stealing an active session through:

• Network sniffing (prevented by HTTPS)
• Cross-site scripting (XSS)
• Malware on the endpoint
• Session ID in URL (referrer leakage)

Cookie Security

Essential Cookie Attributes:

Set-Cookie: session=abc123;
    HttpOnly;       # Prevents JavaScript access (XSS protection)
    Secure;         # Only sent over HTTPS
    SameSite=Lax;   # CSRF protection
    Path=/;         # Scope limitation
    Max-Age=3600;   # 1 hour expiration

Best Practices

Token Generation

• Use cryptographically random session IDs (128+ bits of entropy)
• Never use predictable values (timestamps, sequential numbers)
• Server-side session storage (not client-side)

Session Lifecycle

• Regenerate ID on authentication and privilege change
• Set appropriate timeout (idle and absolute)
• Implement secure logout that destroys server-side state
• Limit concurrent sessions per user

Stateless Sessions (JWT)

If using JWT for sessions:

• Short expiration times (15 minutes)
• Refresh token rotation
• Token revocation capability
• Store in httpOnly cookies

SuperClue Session Module

SuperClue's cookie audit checks session cookie security attributes, and its API key and session module tests how session tokens are handled in the web applications you scan.