The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Securing Session Management

The defensive measures that web applications must take to prevent attacks on

their session management mechanisms correspond to the two broad cate-

gories of vulnerability that affect those mechanisms. In order to perform ses-

sion management in a secure manner, an application must generate its tokens

in a robust way and must protect these tokens throughout their lifecycle from

creation to disposal.

Generate Strong Tokens

The tokens used to re-identify a user between successive requests should be

generated in a manner that does not provide any scope for an attacker who