InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Best practices for secure session management including token generation, cookie attributes, fixation prevention, and timeout strategies.
Overview
Session management maintains user state across stateless HTTP requests. Insecure session handling is one of the most common web vulnerabilities, enabling attackers to impersonate legitimate users.
Session Lifecycle
Example
Secure Session Lifecycle:
============================
1. CREATION (post-authentication)
- Generate cryptographically random session ID (128+ bits)
- Store session data server-side
- Set secure cookie with proper attributes
2. VALIDATION (each request)
- Verify session exists and is not expired
- Check session binding (IP, user-agent fingerprint)
- Regenerate ID on privilege change
3. EXPIRATION
- Idle timeout: 15-30 minutes (configurable)
- Absolute timeout: 4-8 hours max
- Server-side invalidation
4. DESTRUCTION (logout)
- Delete server-side session data
- Clear/expire session cookie
- Invalidate all related tokens
Secure Cookie Configuration
python example
from flask import Flask, session
import secrets
app = Flask(__name__)
app.config.update(
SECRET_KEY=secrets.token_hex(32),
SESSION_COOKIE_NAME='__Host-session', # Host prefix
SESSION_COOKIE_SECURE=True, # HTTPS only
SESSION_COOKIE_HTTPONLY=True, # No JS access
SESSION_COOKIE_SAMESITE='Lax', # CSRF protection
SESSION_COOKIE_PATH='/', # Scoped to path
PERMANENT_SESSION_LIFETIME=1800, # 30 min idle timeout
)
# Cookie attributes explained:
# Secure: Only sent over HTTPS (prevents network sniffing)
# HttpOnly: JavaScript cannot access (prevents XSS theft)
# SameSite=Lax: Not sent in cross-site POST (prevents CSRF)
# __Host- prefix: Forces Secure, no Domain, Path=/ (strictest)Session Attacks and Prevention
| Attack | Description | Prevention |
|---|---|---|
| Session Hijacking | Steal session token (XSS, sniffing) | HttpOnly, Secure flags, HTTPS |
| Session Fixation | Force victim to use attacker's session ID | Regenerate ID on login |
| Session Prediction | Guess valid session IDs | CSPRNG, 128+ bit IDs |
| Cross-Site Cookie Manipulation | Override cookie from related subdomain | __Host- prefix, SameSite |
Example
import secrets
import hashlib
import time
class SecureSessionManager:
"""Production-ready session management."""
def __init__(self):
self.sessions = {}
self.idle_timeout = 1800 # 30 minutes
self.absolute_timeout = 28800 # 8 hours
def create_session(self, user_id: int, ip: str, user_agent: str) -> str:
"""Create new session with proper security controls."""
# Cryptographically secure random ID
session_id = secrets.token_urlsafe(32) # 256 bits of entropy
self.sessions[session_id] = {
"user_id": user_id,
"created_at": time.time(),
"last_activity": time.time(),
"ip_hash": hashlib.sha256(ip.encode()).hexdigest()[:16],
"ua_hash": hashlib.sha256(user_agent.encode()).hexdigest()[:16],
}
return session_id
def validate_session(self, session_id: str, ip: str, user_agent: str) -> dict:
"""Validate session with timeout and binding checks."""
session = self.sessions.get(session_id)
if not session:
return {"valid": False, "reason": "Session not found"}
now = time.time()
# Check idle timeout
if now - session["last_activity"] > self.idle_timeout:
del self.sessions[session_id]
return {"valid": False, "reason": "Idle timeout"}
# Check absolute timeout
if now - session["created_at"] > self.absolute_timeout:
del self.sessions[session_id]
return {"valid": False, "reason": "Absolute timeout"}
# Update last activity
session["last_activity"] = now
return {"valid": True, "user_id": session["user_id"]}
def regenerate_session(self, old_session_id: str) -> str:
"""Regenerate session ID (call on privilege escalation)."""
session_data = self.sessions.pop(old_session_id, None)
if not session_data:
return None
new_id = secrets.token_urlsafe(32)
self.sessions[new_id] = session_data
return new_id
def destroy_session(self, session_id: str):
"""Completely destroy session on logout."""
self.sessions.pop(session_id, None)
Interview Questions
- What is session fixation and how do you prevent it?
- Session fixation: attacker sets a known session ID in victim's browser (via URL, XSS, or meta tag), then waits for victim to authenticate. The session is now authenticated with an ID the attacker knows. Prevention: always regenerate the session ID immediately after successful login.
- Why should session IDs be regenerated after login?
- To prevent session fixation attacks. Before login, the session ID might be known to an attacker. Regenerating it after authentication ensures the authenticated session uses a fresh, unpredictable ID that only the legitimate user possesses.
- What is the difference between idle timeout and absolute timeout?
- Idle timeout expires sessions after a period of inactivity (protects unattended browsers). Absolute timeout expires sessions after a maximum total duration regardless of activity (limits the window for stolen token usage). Both should be implemented.
- How does the __Host- cookie prefix enhance security?
- The __Host- prefix forces: Secure flag (HTTPS only), no Domain attribute (exact host only, no subdomains), and Path=/ (full site scope). This prevents cookie injection from subdomains and ensures the cookie can only be set by the secure site itself.
- How would you handle session management in a microservices architecture?
- Options: centralized session store (Redis) shared by all services, JWT tokens (stateless but harder to revoke), API gateway that validates sessions and adds user context to internal requests, or each service validates tokens against an auth service. Trade-offs between statefulness and revocability.
Continue the lesson path
Study next in this module
01Web SecuritySecure Coding Practices — Information SecurityEssential secure coding practices for web developers covering input validation, output encoding, error handling, and OWASP guidelines for building resilient applications.02Web SecuritySQL Injection Attacks and PreventionComplete guide to SQL injection vulnerabilities covering attack types, exploitation techniques, prevention with parameterized queries, and real-world case studies.03Web SecurityHTTPS and SSL/TLSDeep dive into HTTPS, SSL/TLS protocol handshake, certificate verification, cipher suites, and secure transport layer communication.04Web SecurityIntroduction to Web SecurityComprehensive overview of web application security, common vulnerabilities, OWASP Top 10, and the security mindset for protecting modern web applications.