BERRY9 IT Services, home +91 86868 92922

Session Management Flaws: Cookies and JWTs

A session is the long-term authentication state of an application — the thing that means a user does not retype their password on every request. When sessions are wrong, every other defense is downstream of the bug. Here are the patterns we look for and the patterns that actually work.

Request a scoping call Call +91 86868 92922

Web applications · By Thimmagurudu Bathini · Published · 6 min read · Last reviewed

  • HttpOnly, Secure, SameSite flags set correctly. Missing HttpOnly means XSS becomes session hijack.
  • Session rotation after login, after privilege change, after password reset. Static session IDs across these boundaries are a finding.
  • Idle timeout and absolute timeout. An hour of inactivity, eight to twelve hours absolute, for sensitive applications. Permanent sessions are an anti-pattern.
  • Logout actually invalidates server-side. A surprising number of apps just clear the client cookie.

JWT sessions — what we test

JWTs are popular and easy to get wrong. We verify algorithm allowlist (no none, no algorithm confusion), signature verification on every request, expiry enforced server-side, refresh token rotation, and revocation lists for compromised tokens. JWTs are not session storage — they are bearer credentials. Treat them accordingly.

Concurrent session policies

For high-value applications, count concurrent sessions per user and notify or block on excess.

The thing nobody tests

Session fixation on the pre-login flow. Many applications set a session cookie on first page load and reuse it after login without rotation. Anyone who can plant that cookie (subdomain XSS, network MITM, even a shared link with a session ID in it) inherits the login.

Deeper coverage in our JWT attacks post and the web VAPT service.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp