Web › Module 7 › Lesson 2
Session and Cookie Failures
Session IDs are bearer proof — flags, fixation, logout, idle timeout.
Visual · session_cookie_failures
Cookie jar: HttpOnly, Secure, SameSite, rotate on login, kill on logout. — router STOP — SAFE No cookie-steal kits.
Opening
A session cookie is a temporary password the browser carries — treat it like one.
OWASP Top 10:2025 A07 Authentication Failures includes session mismanagement: predictable IDs, fixation, missing Secure/HttpOnly/SameSite, no rotation after login, logout that only clears UI state, endless idle sessions. Attacker goal: use someone else’s bearer session. Cyberlium literacy: name the flags and lifecycle on an app YOU run — first; 0.0.1:8774. Not BeEF, not XSS cookie steal packs, not foreign sites, not hydra. Next lesson covers JWT pitfalls as another bearer token shape. Today: classic sessions and cookies.
1. Session ID properties: entropy, unpredictability, server binding
Session identifiers must be long and random from a CSPRNG, stored server-side (or as a signed opaque reference), and never derived from usernames or timestamps alone. Predictable IDs are A07. On YOUR app, use the framework session library defaults unless you have a reason — inventing “user-1-session” fails.
Bind sessions to user id and issued-at. Invalidate server-side on logout and password change. Client-only localStorage clears are not enough if the server still accepts the old id.
Command guide
A07 Authn — Session ID properties
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8774"
Command — copy this
curl -sS -m 3 -D - "$SAFE/" -o /dev/null | grep -i -E "set-cookie|session"
2. Cookie flags: Secure, HttpOnly, SameSite — what each buys
Secure: only HTTPS (or localhost exceptions in browsers). HttpOnly: not readable from JavaScript — reduces XSS impact on the session cookie (XSS still bad; Module 5). SameSite=Lax or Strict: reduces CSRF cross-site cookie sending (CSRF also needs tokens — Module 5 / A01-era habits). Document your choices for the loopback app you own. The teaching toy on 8774 shows broken vs fixed Set-Cookie.
Path and Domain scoping matter: overly broad Domain shares cookies across siblings you did not intend. Prefer host-only cookies for app sessions.
Command guide
A07 Authn — Cookie flags
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8774"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | grep -i set-cookie
3. Fixation and rotation: new id after privilege change
Session fixation: attacker sets a known session id, victim logs in, id stays valuable. Defense: rotate session id on login and on privilege elevation. Idle and absolute timeouts limit stolen-session lifetime. On YOUR stack, confirm rotation; do not steal classmate cookies “to demo fixation.”
Concurrent session policy is a product choice — note whether you allow multi-device and how revoke works.
4. Logout means server revoke — not only a UI redirect
Logout must invalidate the server session record (or denylist the token). Clearing a cookie while the server still accepts it is an A07 miss. Password change should kill other sessions. Write that requirement into notes.
No cookie-steal kits. No foreign targets. No hydra on the router. chmod 600 notes.
5. Wrong vs right: steal kits vs flag+lifecycle review
Same word “session,” opposite ethics.
Wrong
BeEF / cookie steal against strangers. Hydra the router. Skip HttpOnly “so JS can help.” Logout only clears React state. Predictable session ids. nmap the LAN.
Right
Identify DEMO; router → SAFE. Review YOUR loopback cookies: Secure/HttpOnly/SameSite, rotate on login, server revoke on logout; lock session-cookie-notes.txt. Next: JWT Pitfalls.
6. Hands-on: cookie toy on 8774 + session-cookie-notes.txt
Start a07_cookie_toy.py (127.0.0.1:8774). curl -sS -D - broken vs fixed /login and compare Set-Cookie. Fill the checklist. No steal kits.
Mission: session-cookie-notes.txt (mode 600)
1) 0.0.1:8774 after starting a07_cookie_toy.py.2) Document Secure/HttpOnly/SameSite and rotation/revoke; capture broken vs fixed Set-Cookie with curl -D -. 3) chmod 600 $HOME/cyberlium-lab/session-cookie-notes.txt. No steal kits. No hydra. No nmap.
Stuck? Ask Cyberlium AI Mentor
If sessions still mean “steal the cookie,” ask for a hint — not a kit. Try: "Hint only: what HttpOnly/Secure/SameSite each buy; why rotate on login; why logout must revoke server-side; why 192.168.0.1 router login is OUT OF SCOPE?" You still fill session-cookie-notes.txt.
Sessions are bearer proofs with a lifecycle. A07 fails when flags and revoke are missing. Original Cyberlium — not official OWASP certification. Next — JWT Pitfalls.
Knowledge Check
APPLY: Logout clears React state but the server still accepts the old session id. What failed?
Multiple choice
Knowledge Check
APPLY: True or False: Session fixation defenses include rotating the session id after login.
True or False
Knowledge Check
APPLY: curl of http://192.168.0.1/ is router admin. Next for the cookie lab?
Multiple choice