Checking Session Security

Overview

Audit session management implementations in web applications to identify vulnerabilities including session fixation (CWE-384), insufficient session expiration (CWE-613), and cleartext transmission of session tokens (CWE-319).

Prerequisites

• Application source code accessible in ${CLAUDE_SKILL_DIR}/
• Session management code locations identified (auth modules, middleware, session stores)
• Framework and language identified (Express.js, Django, Spring Boot, Rails, ASP.NET, etc.)
• Session configuration files available (session.config.*, settings.py, application.yml)
• Write permissions for reports in ${CLAUDE_SKILL_DIR}/security-reports/

Instructions