Ravindra BagaleCourses & study guides

41. Session Hijacking – Tokens, Cookies and Defence

41.8 Defence Hardening Checklist

By Last updated:

SME / lab checklist (print for Rani):

  1. HTTPS everywhere on auth and cookies; HSTS
  2. Cookie flags: Secure, HttpOnly, SameSite=Lax (or Strict where UX allows)
  3. Regenerate session ID on login and privilege elevation
  4. Short idle / absolute TTL; "remember me" = separate hardened design
  5. Logout destroys server-side session, not only browser cookie clear
  6. MFA for admin / payout / email-change
  7. CSRF tokens on state-changing requests
  8. XSS hygiene + CSP on app pages
  9. Avoid SID in URL; avoid tokens in localStorage for high-value sessions when cookie pattern fits
  10. Monitor concurrent sessions; admin "kill sessions" button
  11. WAF rules for common session abuse patterns (support, not sole control)
  12. Framework updates – session libs have CVEs historically
<?php
// OWN lab PHP sketch – after password verified (illustrative)
session_start();
// ... verify password against DB (prepared statements) ...
session_regenerate_id(true);
$_SESSION['user'] = 'rani';
$_SESSION['login_at'] = time();
// php.ini / ini_set ideas for lab:
// session.cookie_httponly = 1
// session.cookie_secure = 1   // needs HTTPS
// session.cookie_samesite = Lax
?>
Red team (attacker) does Blue team (defender) detects / stops
Hopes logout only cleared client cookie Server-side session destroy + new ID
Uses week-old stolen cookie Short TTL + idle timeout + absolute timeout
Targets admin without MFA MFA + regenerate + alert on admin UA/IP change

Ravindra Bagale's Tip

Make the checklist your wallpaper – but prove it with curl before/after in the lab. A paper policy without regenerate = false comfort. Interview: walk through 5 controls without reading your notes.

Practice task

Score Sahyadri Traders current fictional portal 0–12 on the checklist. Pick worst 3 gaps; write owner email in professional English proposing fix order (HTTPS → flags → regenerate → TTL → MFA).