--- title: "Lock down session cookies ยท Agent Wranglers" url: https://agentwranglers.se/playbook/application-security/authentication-and-sessions/session-cookies id: APS-16 level: Required applies: accounts risk: takeover updated: 2026-10-27 build: a2a6bdfed830 tokens: 1257 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Lock down session cookies For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Authentication and sessions](https://agentwranglers.se/playbook/application-security/authentication-and-sessions.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: APS-16 - Level: Required - Chapter: [Authentication and sessions](https://agentwranglers.se/playbook/application-security/authentication-and-sessions.md) - Rule: Mark session cookies `HttpOnly`, `Secure` and `SameSite=Lax` or `Strict`. Issue a new session at login and end it at logout, after idle time and after a fixed lifetime. - Check: Read the `Set-Cookie` header after login. The name starts with `__Host-`, it has all three flags, and the session ID differs from the one before login. After logout, the old cookie gets 401. On the test copy, a test admin session left idle for 16 minutes gets 401 too. - Risk: An account or system taken over - Applies when: The project has user accounts. - How: Set the cookie flags in your session library. Name the cookie with the `__Host-` prefix, so a subdomain cannot set or replace it. Make a fresh session ID of at least 128 random bits after login, so an ID set before login is worthless. Delete the session on the server at logout. Set the idle and total limits by risk, as NIST SP 800-63B-4 does by assurance level. A password-only session may last up to 30 days. With a second factor, end it after 1 hour idle and 24 hours in total. Staff and admin sessions end after 15 minutes idle and 12 hours in total. See the [website cookie rule](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/cookie-attributes.md). ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### HTTP example ```http Set-Cookie: __Host-session=AbC123; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=43200 ``` ## Sources - [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) - [IETF draft rfc6265bis on HTTP cookies](https://datatracker.ietf.org/doc/draft-ietf-httpbis-rfc6265bis/) - [NIST SP 800-63B-4 on session management](https://pages.nist.gov/800-63-4/sp800-63b.html#sessmgmt) ## Related rules - ACC-26 [Let a remembered device skip only the second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/remembered-device.md) in Accounts and identity - ACC-27 [List every signed-in device](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/session-list.md) in Accounts and identity - ACC-66 [Notice when a session cookie moves to another device](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/stolen-session-detection.md) in Accounts and identity - ACC-61 [Remove access when the directory says so](https://agentwranglers.se/playbook/accounts/business-sign-on-and-provisioning/deprovision.md) in Accounts and identity - APP-76 [Keep tokens and sensitive data out of browser storage](https://agentwranglers.se/playbook/app-ui/client-and-server-state/sensitive-data-out-of-browser-storage.md) in Web app interface - APP-48 [Survive an expired session](https://agentwranglers.se/playbook/app-ui/sessions-and-permissions/session-expiry.md) in Web app interface - AXS-36 [Give people enough time](https://agentwranglers.se/playbook/accessibility/forms-changes-and-time/time-limits.md) in Accessibility - ECM-12 [Merge the guest cart into the account cart on sign-in](https://agentwranglers.se/playbook/ecommerce/carts-and-checkout/cart-merge.md) in E-commerce and fulfilment - APS-14 [Make tokens from a secure random source](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/secure-random-tokens.md) in Application security - APS-17 [Set cookies safely or not at all](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/cookie-attributes.md) in Application security **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers application security playbook`. In code you write, add a comment next to it with the same link. - Previous: [Trust an email domain only after strict parsing](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/strict-email-parsing.md) - Next: [Set cookies safely or not at all](https://agentwranglers.se/playbook/application-security/authentication-and-sessions/cookie-attributes.md) - [Authentication and sessions](https://agentwranglers.se/playbook/application-security/authentication-and-sessions.md)