Audit session management for weak IDs, fixation risks, and cookie misconfigurations.
npx skills add https://github.com/Q16G/aster --skill session-security
Please help me install this Agent Skill. Skill: session-security Source: https://github.com/Q16G/aster/tree/main/skills/code-audit/session-security Command: npx skills add https://github.com/Q16G/aster --skill session-security
会话管理中的常见漏洞包括会话ID生成的可预测性、会话固定攻击以及 Cookie 安全属性配置不当。本 Skill 提供系统化的审计视角，以便在代码层面发现并修复这类风险，从而降低账号劫持和会话劫持风险。
在你的项目中运行本技能以审计会话管理并输出风险报告。
High-intent search queries and answers about installing and using this skill.
To audit session management, analyze session ID generation for cryptographic randomness, verify session regeneration on authentication state changes, and check cookie security misconfigurations across the codebase to detect fixation risks and weak entropy.
Session fixation occurs when an attacker forces a victim to use a predictable session ID. Prevent account takeover by enforcing session regeneration or destroying and recreating the session upon login and privilege changes.
Check cookie security attributes by verifying that HttpOnly, Secure, SameSite, Path, and expiration policies are explicitly configured and consistent across your web application to prevent unauthorized session access or hijacking.
Yes, this session security audit applies to projects with login flows and session-based authentication across various languages and frameworks, analyzing session handling and cookie settings universally.
Your web application needs session ID regeneration on login to prevent session hijacking and fixation attacks. Regenerating the session ID after authentication ensures attackers cannot exploit pre-login session identifiers to impersonate users.
Auditing session lifecycle and cookie settings in microservice architectures requires consistent tracking across distributed services. Complex authentication flows may obscure session state changes, making it difficult to verify uniform HttpOnly and Secure attribute enforcement globally.
V1vek98Identify and report security vulnerabilities in a codebase.
jvalinskyAudit Objective-C source files for cryptographic vulnerabilities and anti-patterns.
lprior-repoOrchestrate Zellij sessions to isolate and manage user workspaces.
0xSheAnalyze PHP source code for session and cookie security flaws.
