Session management basics for web applications

What it is

A session ties a sequence of requests to an authenticated principal. OWASP's cheat sheet sets the properties of a session identifier (at least 64 bits of entropy, meaningless content, transmitted only in cookies with protective attributes) and the lifecycle rules (regenerate on privilege change, absolute and idle timeouts, server-side invalidation on logout).

Why it matters

A guessable, long-lived or leaked session id is equivalent to the password. Most account-takeover paths in web applications go through sessions, not through cryptography.

How to apply

• Generate ids with a cryptographic random source; store them hashed if the store could leak.
• Set Secure, HttpOnly, SameSite, a narrow Path and no Domain wider than needed.
• Regenerate the id at login and at role changes; invalidate all sessions on password change.
• Enforce idle and absolute timeouts server-side; a client-side expiry alone is not a control.
• For APIs used by agents, prefer bearer keys or short-lived tokens over cookies; they do not need CSRF handling.

Pitfalls

Session ids in URLs are logged and shared. Stateless signed tokens cannot be revoked before expiry unless a revocation list exists; keep their lifetime short. Remember-me tokens need the same care as passwords.