Session Security

Harden Authenticated Sessions Against Hijacking

Authentication does not end when a password, passkey, or second factor is accepted. After login, most applications represent the user’s authenticated state with a session credential. Anyone who obtains that credential may be able to act as the user without repeating the original authentication. Session security therefore depends on protecting the credential throughout its lifecycle: creation, transport, use, rotation, expiration, and revocation. Treat the session identifier as a credential A session identifier should be unpredictable and generated with a cryptographically secure random generator. It should not encode sequential database IDs, timestamps, usernames, or other values an attacker can infer.