Sessions Lab
Harden session cookies and CSRF token on YOUR $REPO lab app — local dev only.
Visual · t17_sessions_lab
Lab: session + CSRF on $REPO. Original Cyberlium.
Ship cookie flags and a CSRF token in your repo — not a token harvest from someone else's site.
In YOUR lab web app ($REPO): (1) set HttpOnly, Secure (note dev HTTPS or document exception), SameSite on session cookie; (2) add anti-CSRF token to one POST form and validate server-side; (3) document idle timeout value. Test locally only. Save notes under $HOME/cyberlium-lab chmod 600. No testing session fixation on classmate deployments, no OAuth apps registered to phish real users.
1. Cookie hardening
Show Set-Cookie line or framework config with flags annotated.
Document dev vs prod Secure requirement honestly.
Command guide
Try these commands — Cookie hardening
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Session lab — https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html OAuth literacy — https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
cat > "$HOME/cyberlium-lab/t17-session-checklist.txt" <<'EOF' cookie flags: HttpOnly Secure SameSite csrf: token or SameSite strategy oauth: redirect_uri allowlist; least scopes EOF
Command — copy this
grep -E 'HttpOnly|csrf' "$HOME/cyberlium-lab/t17-session-checklist.txt"
source "$HOME/cyberlium-lab/t17-lab.env" 2>/dev/null; curl -sS -m 2 -o /dev/null -w 'toy HTTP %{http_code}
' "${TOY_APP:-http://127.0.0.1:8820}/" || echo 'Start YOUR toy on 127.0.0.1:8820 when ready'Primary tools to practice this lesson: grep, curl. Reference sites: Session lab (https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html); OAuth literacy (https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. CSRF token
Hidden field or header validated on POST — reject missing or mismatched token.
Screenshot or log redacted success and failure paths.
3. Teardown
Do not commit real session secrets. chmod 600 lab notes.
Revoke any disposable OAuth test app credentials after lab.
4. What you ship: sessions lab evidence
Cookie flag config + CSRF validation proof + timeout note — chmod 600.
5. What you record before the next lesson
Sessions lab notes path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Test CSRF against a bank login you do not own.
- Right: Session/CSRF hardening on $REPO. Next: quiz.
Mission: sessions lab
1) Harden session cookie flags in $REPO. 2) Add CSRF token to one form. 3) Document timeout; secure notes chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Framework CSRF middleware name?”
APPLY: Sessions lab target:
APPLY: True or False: OAuth phishing kits are lab credit.
APPLY: After sessions lab: