thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Session Management

The secure creation, maintenance and termination of user sessions after authentication.

Definition

Good session management uses long, random session IDs from a CSPRNG, regenerates the ID after login and privilege changes, stores tokens in cookies with Secure, HttpOnly and SameSite flags, enforces idle and absolute timeouts and invalidates sessions server-side on logout.

Example

After login, the server issues a new 128-bit random session ID and destroys the pre-login one.

Exam tip

Regenerate session IDs on login to prevent fixation; invalidate server-side on logout.

Related terms