Session management maintains user context in stateless HTTP protocol.
Session mechanisms
- Cookies: Most common, sent automatically with requests.
- Tokens: JWT, OAuth tokens in headers or cookies.
- URL parameters: Legacy, insecure (session ID in URL).
- Hidden form fields: Single-page session tracking.
Session lifecycle
- Creation: User authenticates, server generates session ID.
- Storage: Session data stored server-side (Redis, database).
- Transmission: Session ID sent to client (cookie/token).
- Validation: Server verifies session ID on each request.
- Renewal: Extend session on activity (sliding expiration).
- Termination: Explicit logout or timeout expiration.
Security best practices
- Random session IDs: Use cryptographically secure random generation.
- ID length: Minimum 128 bits to prevent brute force.
- HTTPS only: Secure flag prevents transmission over HTTP.
- HttpOnly flag: Prevents JavaScript access (XSS protection).
- SameSite attribute: CSRF protection.
- Session timeout: Idle timeout (15-30 min) and absolute timeout (24 hours).
- Regenerate ID: New session ID after login (prevent fixation).
- Logout functionality: Clear session data completely.
- Concurrent session limits: Prevent account sharing.
Common vulnerabilities
- Session fixation: Attacker sets victim's session ID before authentication.
- Session hijacking: Attacker steals session ID via XSS, MITM, or sniffing.
- Session prediction: Weak session ID generation enables guessing.
- Insufficient timeout: Long-lived sessions increase exposure window.
- No logout function: Users can't terminate sessions.
- Missing regeneration: Same session ID pre/post authentication.
Storage options
- Server-side sessions: Data stored on server, only ID sent to client.
- More secure, full control over data.
- Requires session storage (Redis, database).
- Client-side sessions: Entire session in JWT or encrypted cookie.
- Stateless, scalable (no server storage).
- Harder to invalidate, size limitations.
Session vs Token authentication
- Sessions: Server stores state, cookie contains session ID.
- Tokens (JWT): Client stores state, server validates signature.
- Hybrid: Token stored in cookie with HttpOnly/Secure flags.
Monitoring and logging
- Log session creation, renewal, and termination.
- Track concurrent sessions per user.
- Alert on anomalies (geo-location changes, simultaneous logins).
- Session replay protection (prevent reuse after logout).
Related Articles
View all articlesThreat Modeling with STRIDE and DREAD: A Complete Guide to Proactive Security Architecture
Master threat modeling with STRIDE and DREAD frameworks to identify, classify, and prioritize security threats before they become vulnerabilities. This comprehensive guide covers data flow diagrams, mitigation mappings, MITRE ATT&CK integration, and building an enterprise threat modeling program.
Read article →FedRAMP Authorization Guide: Cloud Security for Federal Government Compliance
Complete guide to FedRAMP authorization for cloud service providers. Learn impact levels, JAB vs Agency authorization paths, 3PAO assessment, continuous monitoring requirements, and documentation essentials with practical timelines and costs.
Read article →CI/CD Pipeline Security Workflow | DevSecOps Best Practices
Master the complete CI/CD pipeline security workflow from secrets management to SLSA framework implementation. Implement SAST, DAST, SCA, artifact signing, and policy enforcement to secure your software supply chain.
Read article →
Cloud Migration & Validation Workflow | Complete Migration
Execute flawless cloud migrations using proven 7R strategies, AWS Well-Architected Framework, and comprehensive validation at every stage—from discovery to production optimization.
Read article →Explore More Identity & Access Management
View all termsAuthentication vs Authorization
Authentication verifies who you are, while authorization determines what you can do.
Read more →FIDO2
An open authentication standard that enables passwordless and phishing-resistant login using hardware security keys or platform authenticators.
Read more →Identity and Access Management (IAM)
The policies and technologies used to verify identities, govern permissions, and log access across systems.
Read more →Kerberos
A network authentication protocol that uses secret-key cryptography and trusted third parties to verify user and service identities without transmitting passwords.
Read more →LDAP (Lightweight Directory Access Protocol)
An open, vendor-neutral protocol for accessing and maintaining distributed directory services over a network.
Read more →Multi-Factor Authentication (MFA)
An authentication method that requires users to provide two or more verification factors to gain access.
Read more →