Secure By Design: Secure Session Management for Web and Mobile Apps

🔐 Why Session Management Matters

Session management is a cornerstone of secure web and mobile applications. Sessions keep users authenticated after login, often using cookies or tokens. Poor session handling can allow attackers to impersonate users, hijack sessions, or bypass authentication entirely.

So, session is how a system “remembers” a user after they authenticate.Think of it like this: You log into a site → the server creates a session → it stores this session ID (often in a cookie or header token) → every time you interact again, your browser or app includes that session info so the server knows it’s you.

✅ Core Best Practices (With Examples)

1. Use Strong, Unpredictable Session IDs

Session IDs should be randomly generated and long enough to resist brute-force attacks. Avoid sequential or predictable formats.

// ASP.NET Core does this by default when using cookie authentication
services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie();

2. Rotate Session ID After Login or Privilege Change

This prevents session fixation, where an attacker sets a known session ID before login and hijacks it after authentication.

// Force regeneration of session ID
await HttpContext.SignOutAsync();
await HttpContext.SignInAsync(userPrincipal);

3. Set Inactivity and Absolute Timeouts

Limit how long a session stays valid to reduce risk if the session is stolen.

services.ConfigureApplicationCookie(options => {
    options.ExpireTimeSpan = TimeSpan.FromMinutes(15);
    options.SlidingExpiration = true;
});

4. Secure Cookies with Flags

Ensure session cookies cannot be accessed via JavaScript or sent over unencrypted channels.

options.Cookie.HttpOnly = true;   // Prevent access via JS
options.Cookie.SecurePolicy = CookieSecurePolicy.Always; // HTTPS only
options.Cookie.SameSite = SameSiteMode.Strict; // Block CSRF

5. Avoid Storing Sensitive Data in Sessions

Only store essential session data like user ID or role. Never store passwords or full profile details.

HttpContext.Session.SetString("UserId", user.Id);
// Don't do: HttpContext.Session.SetString("Password", user.Password);

// Pseudocode for secure token handling
const loginResponse = await api.login(username, password);
secureStorage.set('access_token', loginResponse.accessToken);
secureStorage.set('refresh_token', loginResponse.refreshToken);

val sharedPreferences = EncryptedSharedPreferences.create(
  "auth_prefs",
  MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC),
  context,
  EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
  EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)
sharedPreferences.edit().putString("access_token", token).apply()

// Clear tokens from secure storage
secureStorage.remove('access_token');
secureStorage.remove('refresh_token');

// Optionally revoke on server
await api.revokeToken(refreshToken);

🛠 Tools and Implementation Options

• Distributed session stores: Redis, SQL Server, or cloud-managed caches for scaling.
• Session audits: Track active sessions, IP, device, and expiration metadata.
• Use secure headers: Add Set-Cookie with proper attributes in all responses.
• Token introspection endpoints: Useful for validating tokens in mobile apps.

🧠 Final Tips

• Always destroy session data on logout using HttpContext.SignOutAsync().
• Notify users of new logins from unrecognized devices (e.g., via email).
• Combine secure session handling with proper authentication and authorization controls.
• Monitor for anomalies (e.g., concurrent sessions from different countries).

Series: Secure by Design → Next: Secure Config Management