Session Security

Session Security

A web session allows a website to remember that a user has authenticated or
performed an action during multiple HTTP requests. Because HTTP is normally
stateless, applications use session mechanisms to maintain continuity between
requests.

1. What Is a Web Session?

A session represents a period of interaction between a user and an application.
After successful authentication, the application normally creates an authenticated
session so the user does not need to submit the password with every request.

2. Session Identifiers

A session identifier is a value used by the server to associate incoming
requests with a particular session.

The identifier must be unpredictable. If an attacker can guess or obtain another
user’s session identifier, the attacker may be able to impersonate that user.

3. Session Cookies

Browsers commonly store session identifiers in cookies.

Session cookies should be configured with security attributes appropriate for
the application.

• Secure: sends the cookie over HTTPS.
• HttpOnly: prevents normal JavaScript access to the cookie.
• SameSite: helps control cross-site cookie transmission.

4. Session Hijacking

Session hijacking occurs when an attacker obtains a valid session identifier
belonging to another user.

The attacker may then attempt to use that identifier to access the victim’s
authenticated session.

5. Session Fixation

Session fixation occurs when an attacker causes a victim to authenticate using
a session identifier already known to the attacker.

A major defence is regenerating the session identifier after successful
authentication.

6. Regenerate Sessions After Login

Applications should generate a fresh session identifier after authentication.
In PHP this can be done with session_regenerate_id().

<?php

session_start();

if ( $authentication_successful ) {

	session_regenerate_id( true );

	$_SESSION['authenticated'] = true;
}

7. Session Expiration

Sessions should not remain valid forever. Applications should implement
appropriate idle and absolute session expiration.

• Idle timeout.
• Absolute timeout.
• Logout invalidation.
• Re-authentication for sensitive actions.

8. Secure Logout

Logout should invalidate the authenticated session rather than merely hiding
the user interface.

<?php

session_start();

$_SESSION = array();

session_destroy();

9. HTTPS

Authentication and session traffic should be protected using HTTPS.
Without transport encryption, session identifiers may be exposed through
network interception.

10. HttpOnly Cookies

The HttpOnly attribute helps reduce the ability of client-side scripts to read
session cookies.

It does not make an application immune to cross-site scripting. A successful
XSS attack can still perform actions through the victim’s browser.

11. Secure Cookie Attribute

The Secure attribute instructs the browser to send the cookie only over HTTPS.
This helps prevent accidental transmission of sensitive cookies over plaintext
HTTP connections.

12. SameSite Cookies

SameSite controls when browsers include cookies with cross-site requests.
Appropriate SameSite settings can reduce some cross-site request risks.

13. Cross-Site Request Forgery

CSRF occurs when an attacker causes an authenticated user’s browser to submit
an unwanted request to an application.

Applications should use appropriate CSRF protections such as anti-CSRF tokens
for state-changing requests.

14. Session Storage

Sensitive session information should be stored server-side where practical.
Applications should avoid placing sensitive authentication data directly inside
client-controlled values.

15. Reauthentication

High-risk operations may require the user to authenticate again even when an
existing session is valid.

Examples include changing a password, changing MFA settings, viewing sensitive
financial information or changing important account details.

16. Session Security Checklist

• Use HTTPS.
• Use unpredictable session identifiers.
• Use Secure cookies.
• Use HttpOnly cookies where appropriate.
• Configure SameSite appropriately.
• Regenerate session identifiers after authentication.
• Expire inactive sessions.
• Invalidate sessions during logout.
• Protect state-changing requests against CSRF.
• Require reauthentication for sensitive operations.
• Do not expose session identifiers in URLs.
• Do not log session identifiers unnecessarily.

17. PHP Session Configuration

<?php

session_set_cookie_params(
	array(
		'secure'   => true,
		'httponly' => true,
		'samesite' => 'Lax',
	)
);

session_start();

The exact cookie configuration should match the application’s architecture,
deployment environment and authentication requirements.

18. WordPress Session Considerations

WordPress has its own authentication and cookie mechanisms. Plugin developers
should use WordPress authentication APIs instead of inventing incompatible
authentication systems.

Custom plugins should also avoid exposing authentication cookies, nonces or
other security-sensitive values unnecessarily.

19. Common Session Security Mistakes

• Using predictable session IDs.
• Failing to regenerate sessions after login.
• Sending authentication cookies without HTTPS.
• Failing to configure cookie security attributes.
• Never expiring sessions.
• Failing to invalidate sessions during logout.
• Putting session IDs into URLs.
• Ignoring CSRF.
• Logging session tokens.
• Failing to protect sensitive account changes.

20. Practical Authorized Lab

Build a small PHP application on your local development machine. Create a
login session, inspect how the session cookie is configured, regenerate the
session after authentication and implement a logout mechanism.

Perform all security testing only against systems you own or are explicitly
authorized to test.

21. Knowledge Check

1. What is a web session?
2. Why must session identifiers be unpredictable?
3. What is session hijacking?
4. What is session fixation?
5. Why should sessions be regenerated after login?
6. What does HttpOnly do?
7. What does Secure do?
8. What does SameSite control?
9. Why are session timeouts important?
10. Why should sensitive actions sometimes require reauthentication?

22. Summary

Session security protects the authenticated state of a web application.
Secure cookies, HTTPS, session regeneration, expiration, logout invalidation,
CSRF protection and reauthentication work together to reduce session-related
risks.

Never treat a session identifier as an ordinary piece of data.
It represents authenticated access and must be protected accordingly.