Agent WranglersAPS-16Required
Lock down session cookies
Mark session cookies HttpOnly, Secure and SameSite=Lax or Strict. Issue a new session at login and end it at logout, after idle time and after a fixed lifetime.
How to do it
Set the cookie flags in your session library. Name the cookie with the __Host- prefix, so a subdomain cannot set or replace it. Make a fresh session ID of at least 128 random bits after login, so an ID set before login is worthless. Delete the session on the server at logout. Set the idle and total limits by risk, as NIST SP 800-63B-4 does by assurance level. A password-only session may last up to 30 days. With a second factor, end it after 1 hour idle and 24 hours in total. Staff and admin sessions end after 15 minutes idle and 12 hours in total. See the website cookie rule.
Examples
HTTP example
Set-Cookie: __Host-session=AbC123; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=43200How to check
Read the Set-Cookie header after login. The name starts with __Host-, it has all three flags, and the session ID differs from the one before login. After logout, the old cookie gets 401. On the test copy, a test admin session left idle for 16 minutes gets 401 too.
Sources
- OWASP Session Management Cheat Sheet
- IETF draft rfc6265bis on HTTP cookies
- NIST SP 800-63B-4 on session management
Related rules
- ACC-26 Let a remembered device skip only the second factor in Accounts and identity
- ACC-27 List every signed-in device in Accounts and identity
- ACC-66 Notice when a session cookie moves to another device in Accounts and identity
- ACC-61 Remove access when the directory says so in Accounts and identity
- APP-76 Keep tokens and sensitive data out of browser storage in Web app interface
- APP-48 Survive an expired session in Web app interface
- AXS-36 Give people enough time in Accessibility
- ECM-12 Merge the guest cart into the account cart on sign-in in E-commerce and fulfilment
- APS-14 Make tokens from a secure random source in Application security
- APS-17 Set cookies safely or not at all in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/authentication-and-sessions/session-cookies">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.