Session cookie inventory
Inventory every cookie the app sets, then decide which ones are the session. Flags, scope, and rotation matter more than the cookie name.
Tags: session, cookie, csrf, ato
Checklist
- Name the set: List every Set-Cookie on anonymous browse, login, and refresh. Mark session, CSRF, device, load balancer, and analytics.
- Flags: Secure, HttpOnly, SameSite, and Path on each cookie you called a session. A missing Secure or HttpOnly flag on that cookie is the result.
- Domain scope: Host-only versus a parent Domain. A parent-domain session cookie is sent to sibling hosts.
- Rotation: Compare the value before and after login, a privilege change, and a password or passkey change. Note whether the previous value still works.
- Logout: Logout should clear the cookie and reject it server-side, including any refresh token paired with it. A copied value that still works is the result.
- Fixation: Compare the anonymous value with the authenticated value. Reuse of the same session id across login is the note.
- Sibling apps: Same parent site, different product hosts. A cookie from app A should not be accepted as a session on app B.
- CSRF pairing: For a state-changing route, record whether a CSRF token, a custom header, or SameSite is what the server actually checks. The UI control is not the check.