Session management bridges the gap between authentication and the ongoing user experience. After a user logs in, the application must maintain their authenticated state across multiple requests using session tokens, cookies, or other mechanisms. This category tests whether session identifiers are generated securely, transmitted safely, protected against fixation and hijacking, and properly invalidated on logout. Session management vulnerabilities are particularly dangerous because they allow attackers to take over authenticated sessions without needing the user's credentials. For security professionals, understanding session management is crucial because flaws in this area directly undermine authentication controls, regardless of how strong those controls might be.
OWASP Top 10 Mapping
This testing category relates to the following OWASP Top 10 2021 categories:
Quick Reference
| Test ID | Name | CWEs | Difficulty |
|---|---|---|---|
| WSTG-SESS-01 | Session Management Schema | CWE-330, CWE-384 | Intermediate |
| WSTG-SESS-02 | Cookie Attributes Testing | CWE-614, CWE-1004 | Intermediate |
| WSTG-SESS-03 | Session Fixation Testing | CWE-384 | Intermediate |
| WSTG-SESS-04 | Exposed Session Variables | CWE-200, CWE-598 | Intermediate |
| WSTG-SESS-05 | CSRF Testing | CWE-352 | Intermediate |
| WSTG-SESS-06 | Logout Testing | CWE-613 | Intermediate |
| WSTG-SESS-07 | Session Timeout Testing | CWE-613 | Intermediate |
| WSTG-SESS-08 | Session Puzzling | CWE-384 | Intermediate |
| WSTG-SESS-09 | Session Hijacking | CWE-384, CWE-614 | Intermediate |
Detailed Test Cases
WSTG-SESS-01: Session Management Schema
IntermediateThis test evaluates the overall session management implementation including how session tokens are generated, their randomness, length, and whether they contain embedded sensitive information. It also checks the session lifecycle from creation through destruction.
What to Check
- Analyze session token length, character set, and entropy
- Test for predictable patterns by collecting and comparing multiple session tokens
- Check if session tokens contain encoded user data (Base64 decode to inspect)
- Verify that new session tokens are generated after authentication events
- Confirm the session management mechanism is resistant to token prediction attacks
WSTG-SESS-02: Cookie Attributes Testing
IntermediateThis test examines the security attributes set on session cookies, including Secure, HttpOnly, SameSite, Domain, Path, and Expires/Max-Age flags. Missing or misconfigured cookie attributes can expose session tokens to theft through various attack vectors.
What to Check
- Verify the Secure flag is set to prevent transmission over HTTP
- Confirm HttpOnly flag is set to prevent JavaScript access
- Check SameSite attribute is set to Strict or Lax to prevent CSRF
- Review Domain and Path attributes for overly broad scope
- Verify appropriate Expires or Max-Age values are set
WSTG-SESS-03: Session Fixation Testing
IntermediateSession fixation testing checks whether the application regenerates the session identifier after successful authentication. Without regeneration, an attacker can set a known session ID before the victim logs in and then use it to access the authenticated session.
What to Check
- Record the session ID before login, then check if it changes after successful authentication
- Test whether session IDs provided in URL parameters are accepted by the server
- Check if session IDs can be set through cookie injection techniques
- Verify that the old session ID is invalidated after a new one is generated
- Test if session fixation is possible through cross-subdomain cookie injection
WSTG-SESS-04: Exposed Session Variables
IntermediateThis test checks whether session tokens or session-related data are exposed through insecure channels such as URLs (Referer header leakage), error messages, logs, or cached pages. Exposed session variables can be captured by third parties or found in server logs.
What to Check
- Check if session tokens appear in URLs as query parameters
- Verify that session data is not leaked through Referer headers to third-party sites
- Test whether error pages or debug output expose session-related information
- Check server logs for session token recording
- Verify that session data is not exposed through browser history or cached pages
WSTG-SESS-05: CSRF Testing
IntermediateCross-Site Request Forgery (CSRF) testing checks whether the application protects state-changing operations from being triggered by malicious sites that the user visits while authenticated. CSRF exploits the trust that the server places in the user's browser.
What to Check
- Check for anti-CSRF tokens in forms that perform state-changing operations
- Verify that anti-CSRF tokens are validated server-side and are unique per session
- Test if removing or modifying the CSRF token still allows the request to succeed
- Check SameSite cookie attribute which provides CSRF protection at the browser level
- Test if sensitive actions can be performed via GET requests (which bypass some CSRF protections)
WSTG-SESS-06: Logout Testing
IntermediateThis test verifies that the logout function properly destroys the session on the server side, clears session cookies on the client side, and that the session token cannot be reused after logout. Incomplete logout leaves sessions vulnerable to reuse.
What to Check
- Verify that clicking logout destroys the session on the server (not just client-side)
- Test whether the session token can be reused after logout by replaying it
- Check that session cookies are properly cleared with appropriate expiration values
- Verify that the back button does not display authenticated content after logout
- Test if logout invalidates all sessions for the user or only the current one
WSTG-SESS-07: Session Timeout Testing
IntermediateThis test verifies that sessions expire after an appropriate period of inactivity (idle timeout) and after a maximum absolute lifetime. Sessions that persist indefinitely increase the window of opportunity for session hijacking.
What to Check
- Test the idle timeout by waiting without activity and then attempting to use the session
- Verify that a maximum session lifetime exists regardless of activity
- Check if the session timeout is enforced server-side, not just via client-side JavaScript
- Test whether session timeout values are appropriate for the sensitivity of the application
- Verify that expired sessions cannot be revived by sending requests with the old token
WSTG-SESS-08: Session Puzzling
IntermediateSession puzzling (session variable overloading) occurs when the application uses the same session variable for different purposes across different parts of the application. An attacker can set a session variable in one context and exploit it in another context to bypass security controls.
What to Check
- Map all session variables used across different application functions
- Identify session variables that are set in one context and read in another
- Test whether manipulating session variables through one function affects others
- Check if unauthenticated functions set session variables used by authenticated functions
- Verify that session variables have well-defined scopes and purposes
WSTG-SESS-09: Session Hijacking
IntermediateSession hijacking testing evaluates the overall resilience of the session management implementation against various token theft and replay techniques. This includes testing network-level interception, XSS-based theft, and whether additional controls like IP binding or device fingerprinting are in place.
What to Check
- Test whether sessions are bound to additional client attributes (IP, User-Agent)
- Verify that concurrent session limits or alerts exist for the same account
- Check if the application detects and responds to session token replay from different locations
- Test whether Man-in-the-Middle attacks can capture session tokens on the network
- Verify that all session management protections work together as defense in depth
Relevant Certifications
The following certifications cover session management testing concepts:
Frequently Asked Questions
What is session hijacking and how does it work?
Session hijacking occurs when an attacker obtains a valid session token belonging to another user and uses it to impersonate that user. This can happen through network sniffing (if cookies lack the Secure flag), cross-site scripting (if cookies lack HttpOnly), session fixation, or physical access to the user's browser. Once the attacker has the session token, the server cannot distinguish them from the legitimate user.
What is session fixation and how is it different from session hijacking?
Session fixation is an attack where the attacker sets (fixes) the session ID before the victim logs in, rather than stealing it after. The attacker provides a known session ID to the victim (through a crafted URL or cookie injection), waits for the victim to authenticate, and then uses that same session ID to access the authenticated session. Prevention requires regenerating the session ID after successful login.
What cookie security attributes should be set on session cookies?
Session cookies should have the Secure flag (transmitted only over HTTPS), HttpOnly flag (inaccessible to JavaScript, preventing XSS-based theft), SameSite attribute (Strict or Lax, preventing CSRF), appropriate Path and Domain restrictions, and a reasonable expiration. Missing any of these attributes weakens session security.
CyberFolio
Mastering web security testing? Showcase your skills.
Build a free, shareable cybersecurity portfolio that highlights your certifications, projects, and skills.
Build Your Portfolio →