Session Management Controls to Verify Before Release
State transition and replay closure
Draw session lifecycle from anonymous visit through login, step-up, role elevation, password reset, factor replacement, logout, idle timeout, and absolute timeout. Identify session secret generation, server record, browser or client transport, rotation, and revocation store. Secure, HttpOnly, and deliberate SameSite cookie settings help browser transport; they do not invalidate a copied secret without server-side state.
Run replay tests with separate sessions. After password reset, replay a cookie issued before reset; after a role elevation, replay pre-elevation identifier; after logout, repeat an authenticated request; after timeout, send request at controlled clock boundary. Expected output combines rejection, no protected state, and revocation record. Inspect URL, referrer, browser history, and logs for session secrets because query-string transport can leak beyond client storage.
Fixes centralize issuance and revocation, rotate identifiers after authentication changes, and make expiry checks authoritative server-side. For native applications, use equivalent protected storage and proof-of-possession controls where cookies do not apply. A support exception must specify exact recovery action and session invalidation behavior. Closure test confirms old secret fails while current session remains usable only where policy intends.
Concurrency changes expected behavior. Logging out in one device may revoke all sessions or only one session according to policy; test both device records and request replay. Rotation must not create a window where old and new identifiers work indefinitely. When browser protection uses SameSite, test intended cross-site login or payment return flow rather than weakening it globally. Record server time and expiry source because client clock cannot be trusted as revocation authority.
Create and bind a session
Map session creation from anonymous browser state to authenticated record. The server creates an unpredictable identifier, associates it with subject and assurance, and sends it only through selected transport. For browser cookies, collect Secure, HttpOnly, SameSite, domain, path, and expiry attributes from actual response. Cookie attributes reduce browser exposure; server-side lookup and revocation decide whether a copied identifier still works. Never place session secrets in URL, fragment, referrer, analytics payload, or application log.
Test session fixation before login. Supply a chosen pre-authentication identifier, authenticate, then prove a different authenticated secret exists and chosen value cannot access account. Repeat after step-up authentication and role elevation. Expected output includes new identifier, old-identifier denial, current session continuity, and audit event where design requires it. Cookie domain should be as narrow as deployment permits; test subdomain assumptions before sharing a parent-domain cookie.
Rotation, logout, and concurrency
Use two devices and two browser tabs. Log out one device and verify whether policy revokes that device only or all sessions; inspect both server records and replay requests. Start a long-running authenticated operation, then reset password or remove an MFA factor. Before final write, operation must recheck session authority so revocation cannot race with commit. WebSocket and streaming channels require revocation signal or bounded reauthentication, not permanent access from connection-time check.
Logout clears client cookie and invalidates server record. Test repeated logout, back-button navigation, old-cookie replay, and provider or cache outage. An unknown session must not be accepted as outage fallback. Record response headers, revocation-store result, request correlation ID, affected device count, and post-logout API result.
Idle and absolute expiry
Set controlled server time to test inactivity expiry and absolute expiry separately. Activity may refresh idle timer where policy allows, but must not extend absolute lifetime forever. Test background refresh and multiple tabs so one hidden request does not unintentionally maintain session. Reauthentication for sensitive action needs recent proof bound to current session and short validity. Remediate by centralizing issuance, rotation, revocation, expiry checks, and audit. A support recovery exception specifies exact scope, required verification, and session invalidation result. Closure proves pre-event secret fails after password reset, factor replacement, role removal, logout, and expiry while authorized current session behaves as policy states.
Cookie delivery review
Inspect actual Set-Cookie headers through each login and renewal route, including error paths. Confirm secure transport, HttpOnly behavior, intended SameSite mode, narrow domain and path, and expiry consistent with server record. Test cross-site return flow deliberately rather than weakening cookie mode globally. Cookie deletion must match original path and domain or browser can retain an old value. Evidence pairs header capture with server revocation result and replay test.
Session transition replay matrix
| Transition and replay | Owner | Evidence | Expected result | Observed result / status | Exception | Closure |
|---|---|---|---|---|---|---|
| Password reset; replay pre-reset cookie from Device B | Session platform owner | Capture SM-233; revocation-store entry; protected-API response | Old cookie rejected; no protected state; current post-reset session follows policy | 401; protected writes 0; 2 pre-reset records revoked — closed | None | Logout, factor-removal, idle, and absolute-expiry boundary retests passed 2026-06-17 |