Session Management Testing

This guide treats browser and API session management as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Document session cookies, bearer tokens, refresh tokens, and server-side session state.

2. 02

   Record creation, renewal, idle timeout, absolute timeout, and logout behavior.

3. 03

   Map trust changes that should rotate or revoke sessions.

4. 04

   Use designated accounts and redact all session values from evidence.

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Confirm identifiers rotate after authentication and privilege changes.

2. 02

   Verify Secure, HttpOnly, SameSite, scope, and lifetime match the application boundary.

3. 03

   Test logout, password reset, account disablement, and factor removal for revocation.

4. 04

   Compare concurrent-session behavior with policy.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Log session creation, renewal, revocation, and high-risk reuse without storing raw tokens.
• Alert on impossible device changes and refresh-token replay.
• Correlate identity events with session termination.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Use opaque high-entropy identifiers or carefully validated tokens.
• Rotate at trust transitions and revoke server-side.
• Constrain cookie scope and enforce CSRF defenses.
• Shorten high-risk sessions and protect refresh tokens.