Session

HTTP is stateless, so web sessions are layered on top, almost always through cookies (RFC 6265). There are two basic designs. In a server-side session the cookie holds only a random identifier, and state lives in a server store such as memory, Redis or a database; OWASP's Session Management Cheat Sheet requires at least 64 bits of entropy from a cryptographically secure generator. In a client-side or stateless session the cookie or bearer token carries the state itself, signed and often encrypted, as with a JWT. Stateless designs scale easily but cannot be revoked before expiry without a server-side denylist or short lifetimes plus refresh, which is the real trade-off.

Cookie hardening is standard: Secure (HTTPS only, backed by HSTS), HttpOnly (not readable from JavaScript, limiting theft through XSS), SameSite=Lax or Strict (restricting cross-site sending, which blunts CSRF), and the __Host- name prefix, which forces Secure, Path=/ and no Domain attribute so subdomains cannot plant or read the cookie. The session identifier must be regenerated at login and at any privilege change, otherwise an attacker who planted a known ID beforehand inherits the authenticated session (session fixation). Logout must invalidate the session on the server, not just delete the cookie in the browser.

Lifetimes are a policy choice. OWASP suggests idle timeouts of 2 to 5 minutes for high-value applications and 15 to 30 minutes for lower-risk ones, and absolute timeouts of 4 to 8 hours, roughly a working day, for high-risk applications. NIST SP 800-63B-4 sets reauthentication limits by assurance level: at AAL2 no more than 24 hours overall and 1 hour of inactivity, and at AAL3 12 hours overall with inactivity limited to 15 minutes. Sensitive operations such as changing a password or approving a payment should demand fresh authentication regardless of session age.

The dominant modern threat is theft of a session that was created legitimately. Adversary-in-the-middle phishing kits capture the cookie issued after MFA, and infostealer malware exports cookies from browser profiles; MITRE ATT&CK tracks these as Steal Web Session Cookie (T1539) and Web Session Cookie reuse (T1550.004). Binding sessions to the client is the counter: the earlier Token Binding standard (RFC 8471) found little browser support, and newer approaches bind cookies or refresh tokens to a device-held key. Tying a session to an IP address is brittle on mobile networks. With single sign-on there are several layers, the IdP session, each application's session and any OAuth refresh tokens, and ending one does not end the others unless logout is propagated. Application sessions are also distinct from TLS session resumption and from operating-system logon sessions, which share the name but not the mechanism.