VibeSecurity

Access and identity

What is Session cookie?

A session cookie is a small browser cookie that identifies a logged-in user to your server, and in the strict sense one with no expiry date that disappears when the browser session ends. Protect it with Secure, HttpOnly and SameSite.

When you sign in, many sites give your browser a cookie holding a session id. The browser sends it automatically with each request, and the server looks it up to know who you are. Whoever holds the cookie is effectively you.

Weak cookie settings are the failure. Without Secure, it can travel over plain HTTP. Without HttpOnly, an injected script can read it. Without a suitable SameSite value, other sites can trigger requests that carry it. Sites should also issue a fresh cookie on login to prevent session fixation.

Set the cookie with Secure, HttpOnly and SameSite Lax or Strict, keep the id random and unguessable, give it a sensible lifetime, and destroy it on the server when the user logs out. Auth libraries usually do this correctly, so check that custom code did not override their defaults.

A well-configured session cookie
Set-Cookie: session_id=abc123; Secure; HttpOnly; SameSite=Lax; Path=/

Related terms

Sources

  1. 1.MDN: HTTP cookies