Session Management and Cookies

Implement robust, attack-resistant session handling that prevents fixation, hijacking, and theft while maintaining usability.

Session ID Generation and Properties

• Generate session IDs with a CSPRNG; at least 64 bits of entropy (prefer 128+). Opaque, unguessable, and free of meaning.
• Use generic cookie names (e.g., id) rather than framework defaults. Reject any incoming ID not created by the server.
• Store all session data server-side; never embed PII or privileges in the token. If sensitive, encrypt the server-side session store at rest.

Cookie Security Configuration

• Set Secure, HttpOnly, SameSite=Strict (or Lax if necessary for flows) on session cookies.
• Scope cookies narrowly with Path and Domain. Avoid cross-subdomain exposure.
• Prefer non-persistent session cookies (no Expires/Max-Age). Require full HTTPS; enable HSTS site-wide.

Example header: