Session related issues.
So cookies are used to implement session management for Web applications.
In order to avoid attacks against session management, an application should have a good kookie policy
because the session ID that identifies the user is carried in the cookie.
That's why cookies are so very important to an application, my.
So now let's talk about the session ID value that is transported in the cookies, the session ID represents
the user, so after the user logs into the application, it is as important as a login data itself.
Username and password session ID value should be unique, random, unpredictable, and long enough so
these properties can make the session ID resistant to session analyzing and brute force attacks.
But often, very often this is not enough for protection.
The application should transport the session value in a safe way, such as https.
So now we have a session I'd value that is transported safely and it's strong against attacks.
But the last thing is that a session ID should also have a lifetime.
I mean, this is absolutely true.
Assessing value should be created and live until a certain time.
That's why the session ID should have an expiration date.
So in general, for a session ID values, if the expiry date is not set, the season well lasts until
the browser is closed and if it's directly set in the session, ID will be stored in the browser until
the expiry date.
So spend testers, we should check all of these properties and then report all of those findings about
the insecure session ID values.