Server-side session handling.
WHAT A SESSION IS
Server-held state, referenced by an identifier the client presents.
WHAT TO CONFIGURE ON THE COOKIE
Secure transmission only Inaccessible to scripts Restricted cross-site sending An appropriate lifetime
WHAT TO DO ON SIGN-IN
Regenerate the identifier.
WHY
It prevents an attacker who set a known identifier from using it afterwards.
WHAT TO DO ON SIGN-OUT
Destroy the session on the server, not only remove the cookie.
WHAT TO DO ON PASSWORD CHANGE
Invalidate other sessions.
WHAT TO IMPLEMENT
An idle timeout An absolute maximum lifetime
WHAT TO STORE IN THE SESSION
An identifier, and minimal state.
WHAT NOT TO STORE
Large objects Anything that could be stale Anything sensitive, if the store is shared
WHAT TO CONSIDER FOR SEVERAL INSTANCES
A shared session store, since in-process sessions break behind a load balancer.
WHAT THAT LOOKS LIKE WHEN WRONG
Users being signed out apparently at random.
WHAT TO LOG
Sign-ins, sign-outs, and failures.
