Broken Session Management
Broken session management is flaws in how session tokens are generated, stored, or invalidated, letting attackers hijack or forge sessions.
Purpose
To understand hijacking caused by session lifecycle flaws and their defenses; a core topic of Web security.
Mechanism
Flaws include predictable session IDs, no rotation on session fixation, non-expiring sessions, insecure session storage, and session cookies without Secure/SameSite under HTTPS. Defenses: random IDs, rotation on login, timeouts, secure cookie attributes.
Use cases
- Session hijacking defense
- Session security audit
- Cookie security