Session Management

Session management involves managing user sessions to ensure that users are properly authenticated and authorized.

critical for secure coding
enables web applications to uniquely identify a user across a number of different actions and requests
- while keeping the state of the data generated by the user and ensuring it is assigned to only that user
particularly important when it comes to user authentication
- required to ensure the integrity of the user and the data generated by the user while interacting with the web application
prime target for attackers

Cookies and Sessions

HTTP is a stateless protocol
- server preserves no information about the client
but most web applications depend on retaining information about clients
- so various mechanisms are used to preservice this info
  - a cookie is one method

A cookie is text file used to store information about a user when they visit a website.

Some sites use cookies to support user sessions
created when the server sends an HTTP response header with the cookie
types:
- Nonpersistent (session) cookies
  - stored in memory and deleted when the browser instance is closed
- Persistent cookies
  - stored in the browser cache until deleted by the user or pass a defined expiration date
If cookies are used to store confidential information, the web application should encrypt them before sending them to the client
- if using SSL, information in a cookie would be secure in transit but reside on the client computer in plaintext
  - unless separately encrypted

Coding Best Practice	Description
Use secure session IDs	Session IDs should be randomly generated, long, and difficult to guess to prevent guessing or brute-forcing session IDs to gain unauthorized access.
Use secure cookies	Cookies should be marked as secure and set to HTTPS-only to prevent them from being intercepted or modified. Developers should ensure that cookies do not contain sensitive information and expire after a reasonable time.
Implement session timeouts	Sessions should end automatically after a predetermined period of inactivity to prevent abuse.
Use strong password policies	Strong password policies prevent attackers from easily guessing or cracking user passwords.
Use multi-factor authentication	Multi-factor authentication provides an additional layer of security by requiring users to provide more than one form of authentication. This significantly reduces the risk of password attacks.
Implement access controls	Restrict access to sensitive resources and prevent unauthorized access. Developers should ensure that access controls protect sensitive resources and data and that users cannot bypass them.
Protect against session hijacking and fixation	Session hijacking and fixation attacks involve stealing or manipulating a user’s session ID. Developers must utilize secure session IDs and implement secure cookie-handling practices.