skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

auth-session-management

Validate session lifecycle security and cookie attribute hygiene for web applications.

Updated Jul 30, 2026
Search Tags:#security#authentication#audit#session#pentest#cookies
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill auth-session-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-session-management
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/auth-session-management
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill auth-session-management

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the critical risk of insecure session handling, which often leads to account takeover, session fixation, and unauthorized access in web applications.

Core Features & Use Cases

  • Cookie Attribute Audit: Validates the presence of security flags like Secure, HttpOnly, and SameSite to prevent session theft.
  • Lifecycle Validation: Tests session rotation, invalidation on logout, and behavior during password or role changes.
  • Use Case: During a security assessment, use this skill to verify that a web application properly invalidates all active sessions when a user changes their password, ensuring that stolen sessions cannot be reused.

Quick Start

Use the auth-session-management skill to perform a full lifecycle security review on the target application defined in your current scope.

Frequently Asked Questions about auth-session-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test session fixation and verify session rotation during authentication?▼

To test session fixation, you validate session rotation security by verifying that tokens are regenerated upon login, password changes, and role escalations, ensuring stolen or fixed sessions cannot be reused after authentication.

What is the best way to audit cookie attributes for session theft prevention?▼

The best way to audit cookie attributes is to validate the presence of the Secure, HttpOnly, and SameSite flags across the application, ensuring that session cookies are protected against interception and cross-site scripting attacks.

Does this session management test verify logout completeness for active sessions?▼

Yes, this session management test verifies logout completeness by validating proper session invalidation, ensuring that all active user tokens are immediately destroyed and cannot be reused after the user logs out of the web application.

Can I use this approach for red-team engagements and bug bounty programs?▼

Yes, you can use this approach for red-team engagements and bug bounty programs because it applies rigorous authentication testing within defined scopes to uncover insecure session handling and account takeover risks.

Why does my web application keep a session active after a user changes their password?▼

Your web application keeps a session active after a password change due to failing lifecycle validation, which occurs when the system does not properly invalidate existing tokens during credential updates, leaving stolen sessions reusable.

Related Skills

Explore More Software Engineering Skills→
thanh-abaiithanh-abaii
34

gs:setup-browser-cookies

Import Chromium cookies into a Playwright headless browser session.

Community
Intermediate
ersinkocersinkoc
56

sc-session

Detect session-management vulnerabilities across cookie, server-side, and token-based sessions.

Community
Advanced
hung-phanhung-phan

csrf

Implement CSRF prevention with SameSite cookies, tokens, and origin validation.

Community
Advanced
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced