Session management: from token to logout
You examine every step from creating the session token to logging out, recognising fixation, timeout and revocation mistakes with Burp and fixing them in code.
Level 201 · 15 lessons · 13 practice labs
Lessons
The session token
- The session lifecycle: create, use and end
- Token randomness: measuring it with Burp Sequencer
- Where the token travels: cookie, header or URL
- Session cookie flags and prefixes: __Host- and __Secure-
- Short task: find a predictable session token and replace it with a secure generator
Session flaws
- Session fixation: renewing the ID at login
- Timeouts: idle and absolute lifetime
- Really ending the session on the server at logout
- Concurrent sessions and "sign out everywhere"
- Short task: prove and fix a session that still works after logout
Token-based sessions
- Stateless tokens: advantages and the revocation problem
- Storing tokens in the browser: cookie or storage
- Refresh tokens and rotation
- Signs of session hijacking: IP, device and timing mismatches
- Capstone: audit, fix and retest an app’s session management
Practice labs
- Sequential session IDs: Show the lab app hands out sequential session IDs and replace them with a secure random generator.
- A session ID carried in the URL: Find the pages that carry the session ID in the URL, show how it leaks through Referer and move it to a cookie.
- Token randomness with Sequencer: Collect enough samples of the password reset token, show the weak entropy with Sequencer, replace the generator and measure again.
- A token derived from a timestamp: Work out a token derived from a timestamp and user ID, prove in the lab you can predict the next one and fix it.
- A session that still works after logout: Prove requests are still accepted with the old cookie after logout and end the session on the server.
- A session ID not renewed at login: Show the ID stays the same before and after login, leading to session fixation, and issue a new ID at login.
- An endless session: idle and absolute timeouts: Apply idle and absolute timeouts to a session that never ends and test that both limits work.
- Log out from all devices does not work: Prove sessions on other devices stay open after a password change and add a mechanism that ends all of them.
- Session review: the Brivex Cargo panel: Review the full session lifecycle of the fictional Brivex Cargo panel, close three weaknesses and prove it with a retest.
- Needless personal data stored in a JWT: Decode the session JWT to find needless personal data placed in it and reduce its claims to the minimum.
- A JWT that cannot be revoked: Prove a JWT keeps working after the account is closed until it expires and add a short lifetime and a deny list.
- A refresh token that is never rotated: Show the same refresh token can be used again and again, add rotation and revoke the whole chain when an old token is reused.
- Signs of a hijacked session: IP and device: Find the same token used from two countries a short time apart in the session log and write an alert rule that catches it.
About this course
You examine every step from creating the session token to logging out, recognising fixation, timeout and revocation mistakes with Burp and fixing them in code.
What you will learn
- The session token
- Session flaws
- Token-based sessions
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.