Secure Coding Practices for Session Management
Domain 7: Secure Coding Practices for Session Management
This domain tests how an application maintains authenticated state without letting an attacker hijack, fixate, or replay it. The exam focuses on token entropy, cookie handling, lifecycle events, and server-side enforcement.
Core rules and concepts
- Generate session identifiers with a cryptographically secure random generator and sufficient entropy. Do not derive them from predictable data.
- Set cookies with Secure, HttpOnly, and an appropriate SameSite value. Use the __Host- prefix where suitable and avoid session IDs in URLs.
- Rotate the session identifier after login and after privilege changes to prevent session fixation.
- Enforce idle and absolute timeouts. Invalidate the server-side session on logout, password change, and account disablement.
- Keep session state server-side or use a properly validated token. Do not trust client-side role or identity claims without verification.
- Protect state-changing requests with CSRF defenses such as tokens or strict SameSite settings, and validate Origin where appropriate.
Worked example
A user logs in and the application keeps the pre-login session ID. An attacker who planted that ID can fixate the session. A sound flow creates a new session ID at authentication, stores the session server-side, sets a cookie with Secure, HttpOnly, and SameSite=Lax, applies a 15-minute idle timeout and an 8-hour absolute timeout, and destroys the session on logout. A CSRF token is required for state-changing forms. The reasoning is that rotation defeats fixation, cookie flags limit theft and script access, timeouts bound exposure, and server-side invalidation makes logout meaningful.
Traps that cost marks
Do not place session IDs in URLs or logs. Do not use a session that never expires. Do not rely on SameSite alone as the only CSRF control. Do not keep the same session ID after privilege elevation. Do not trust a client-supplied user ID or role. Do not forget to invalidate sessions on password reset.
Review habit
Trace the session from creation to destruction and list every event that must rotate or revoke it.