Session Hygiene

Cookie flags, rotation, and timeout — session defense in YOUR lab app only.

Session Hygiene• Audio Walkthrough

00:00/02:46

Visual · t17_session_hygiene

Sessions = server-side state tied to a token. Original Cyberlium.

A session ID in the URL bar is a souvenir for every shoulder and log file.

Secure sessions use unpredictable IDs, HttpOnly and Secure cookie flags, SameSite where appropriate, idle and absolute timeouts, and rotation after login or privilege change. Store session data server-side or in signed encrypted cookies — never embed roles in client-readable blobs on apps you ship. Practice session config review on YOUR lab repo ($REPO) and local dev server — never harvest session tokens from classmate apps, employer production, or stranger sites.

1. Cookie and token flags

HttpOnly blocks JavaScript theft; Secure requires HTTPS; SameSite reduces cross-site cookie sends.

Session ID length and entropy matter — no sequential integers or username-derived tokens.

Command guide

Try these commands — Cookie and token flags

═══ LINUX / BASH (Network & Reconnaissance Audit) ═══

Scan target host for open ports and service version signatures

Command — copy this

nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}

DNS and WHOIS reconnaissance on authorized domain

Command — copy this

dig +short A target.local
dig +short MX target.local
whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6

Inspect HTTP headers for technology stack fingerprinting

Command — copy this

curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"

Primary tools to practice this lesson: python3, curl. Reference sites: Session management (https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html); Cookie flags (https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.