Secure Session Management Flashcards

What is the best defense against session fixation?

Answer: Issuing a new session ID immediately after successful authentication

In session fixation, the attacker plants a known session ID before the victim logs in. Issuing a new ID at login makes the planted ID useless.

Which cookie attribute stops client-side scripts from reading the session cookie?

Answer: HttpOnly

HttpOnly blocks JavaScript access through document.cookie, which limits session theft through XSS. Secure only restricts the cookie to HTTPS.

What does the SameSite=Strict cookie attribute mainly protect against?

Answer: Cross-site request forgery (CSRF)

SameSite=Strict stops the browser from sending the cookie on cross-site requests. That blocks most CSRF attacks, which depend on the victim's cookies being attached automatically.

Which property is most important for a session identifier?

Answer: It is long, random and generated by a cryptographically secure generator

Session IDs must be unpredictable, with enough entropy (OWASP recommends at least 64 bits) from a CSPRNG, so attackers cannot guess or brute-force valid sessions.

What should happen on the server when a user clicks 'Logout'?

Answer: The server-side session is invalidated and the cookie is cleared

Deleting only the client cookie leaves the server-side session valid, so a stolen ID could be replayed. Proper logout invalidates the session on the server.

Why is putting session IDs in URLs (URL rewriting) considered insecure?

Answer: IDs leak through browser history, logs and Referer headers

Session IDs in URLs end up in server logs, proxy logs, bookmarks, browser history and Referer headers sent to third parties, which makes session hijacking easy.