To test session management, log in and inspect the session cookie flags, confirm the session ID changes after login, log out and replay the old cookie to see if it still works, and check that idle and absolute timeouts are enforced by the server. Each check takes minutes with a proxy.
What good looks like
OWASP's session guidance says identifiers need at least 64 bits of entropy from a secure random generator, cookies should carry Secure, HttpOnly and an explicit SameSite value, and the session ID should be regenerated after login and any privilege change.
Test cases
| Check | How | Pass |
|---|---|---|
| Cookie flags | Read Set-Cookie | Secure, HttpOnly, SameSite present |
| Session fixation | Note ID before login, compare after | ID changes |
| Logout | Replay the old cookie after logout | Rejected |
| Idle timeout | Wait past the limit, then request | Rejected |
| Absolute timeout | Keep active past the cap | Rejected |
| ID in URL | Try passing the ID as a query value | Rejected |
| Caching | Check Cache-Control on authenticated pages | no-store |
Steps
- Capture the login response in a proxy and record the cookie and its flags.
- Request a protected page before login to get a pre-login ID, then log in and compare.
- Copy the post-login cookie. Log out in the browser. Replay the copied cookie with a command line client.
- Change the password in one browser and see if a second session remains valid.
- Test timeouts with your staging settings shortened, or by waiting.
- Try sending a session ID you invented and see whether the server accepts it.
Timeout guidance
OWASP gives example ranges: idle timeouts around 2 to 5 minutes for high value apps and 15 to 30 minutes for lower risk ones, and absolute timeouts of 4 to 8 hours for an office style application. Pick values from your own risk, and enforce them on the server, because client timers can be bypassed.
Common failures
Logout that only clears the cookie in the browser. A session ID that stays the same after login. Tokens stored in places scripts can read.
Try it yourself
Find the cookie related findings and read the evidence column.
Click through it at your own pace, or open it full screen.
Quick check
Is clearing the cookie enough on logout?
No. The server must invalidate the session, or a copied cookie keeps working.
What is session fixation?
An attacker sets a known session ID before login. Regenerating the ID after login prevents it.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning, reachability analysis and policies and gates that can block a pull request, so the libraries behind your app are checked alongside the app itself. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
