The session of a web application is only as safe as the identifier that represents it and the cookie that carries that identifier. Rapplex examines the session cookies seen during the scan, and the URLs that were requested, for settings and values that make a session easier to steal, guess or abuse.

The checks cover the SameSite attribute, the cookie lifetime, the length and randomness of the identifier, sequences of identifiers and identifiers that travel in URLs. The Secure and HttpOnly attributes are reported by other checks.

1. Generate identifiers with a cryptographically secure random generator, with at least 64 bits of entropy (128 bits is recommended), and let the framework do it.

2. Set Secure, HttpOnly and SameSite (Lax or Strict) on every session cookie.

3. Keep sessions short and invalidate them on the server at logout, and on password and privilege changes.

4. Never put session identifiers into URLs. Disable URL rewriting for sessions in the application server.

• OWASP Session Management Cheat Sheet
• OWASP Top 10 - A07:2021 Identification and Authentication Failures
• OWASP Application Security Verification Standard - V3 Session Management