session-management

检查会话令牌的发放、保护、旋转与销毁策略。

检查应用如何签发、保护、更新和销毁会话令牌，包括 cookie 标志、session fixation、登录时旋转和超时策略等细节。用于任何会让用户保持登录状态的应用，属于快速却高价值的安全复核步骤。特别强调传输加密、令牌不可预测与真正登出被终止这几项，能发现容易被忽视但致命的会话漏洞。

## Purpose

A session is what keeps a user logged in after they authenticate, which makes the session token as valuable as the password. This skill covers the properties a session must have — protected in transit, unpredictable, rotated at login, and actually killed at logout — and how to check each one.

## When to use it

On any app that keeps users logged in. Fast to review, and the failures (fixation, missing flags, sessions that outlive logout) are common and directly exploitable.

## Procedure

1. Capture the session cookie after login and inspect its flags. The four that matter are `Secure`, `HttpOnly`, `SameSite`, and a sane `Path`:
   ```
   curl -sI https://app.tld/login -d 'user=.