https://nalar.dev/tags/session-security/ Recent content in Session Security on Nalar Hugo en-us Thu, 03 Sep 2026 00:00:00 +0700 https://nalar.dev/harden-authenticated-sessions-against-hijacking/ Thu, 03 Sep 2026 00:00:00 +0700 https://nalar.dev/harden-authenticated-sessions-against-hijacking/ <p>Authentication does not end when a password, passkey, or second factor is accepted. After login, most applications represent the user&rsquo;s authenticated state with a session credential. Anyone who obtains that credential may be able to act as the user without repeating the original authentication.</p> <p>Session security therefore depends on protecting the credential throughout its lifecycle: creation, transport, use, rotation, expiration, and revocation.</p> <h2 id="treat-the-session-identifier-as-a-credential">Treat the session identifier as a credential</h2> <p>A session identifier should be unpredictable and generated with a cryptographically secure random generator. It should not encode sequential database IDs, timestamps, usernames, or other values an attacker can infer.</p>