OWASP Session Management Cheat Sheet

1. Session ID Properties

   Session ID name, entropy, length and content.

2. Session Management Implementation

   Built-in framework sessions and server-side token storage.

3. Transport Layer Security

   Requiring TLS for session identifiers.

4. Cookies

   Secure, HttpOnly, SameSite, prefixes, domain and path attributes.

5. HTML5 Web Storage API

   localStorage and sessionStorage risks for session tokens.

6. Session ID Life Cycle

   Generation, verification, strict mode and renewal after privilege change.

7. Session Expiration

   Idle and absolute timeouts, manual logout and Clear-Site-Data.

8. Client-side Defenses

   Initial login timeout, automatic client logout and cross-tab sessions.

9. Session Attack Detection

   Brute force detection, anomaly detection and binding sessions to client properties.

10. Simultaneous Logons

    Policies for concurrent sessions.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.