session-management-cookies

Prevent session hijacking by generating unguessable session IDs, setting secure cookie flags, and implementing server-side session fingerprinting. This Skill provides detailed guidelines for risk-based responses and lifecycle management to detect and block suspicious activities.

Secure cookie flags are configured by setting `Secure`, `HttpOnly`, and `SameSite` attributes on session cookies. This Skill demonstrates how to apply these protections to prevent interception and cross-site attacks during web session handling.

Regenerate session IDs immediately upon user login to prevent session fixation. This Skill advises on secure session implementation, including unguessable ID generation and lifecycle management to enhance web application security.

Detect session theft using server-side fingerprinting and risk-based responses to suspicious activities. This Skill describes how to monitor anomalies and implement threat detection mechanisms to protect active user sessions.

High security web applications require session rotation and fingerprinting to prevent hijacking. This Skill provides guidelines for implementing robust session handling tailored to detect anomalies and protect against theft in sensitive contexts.