Web Application Security
Session Management
Session lifecycle — cookies, fixation, CSRF, timeouts, hijack defense.
Eight practical session labs beyond Authentication’s cookie overview: create strong server-side sessions, harden cookie flags, defeat fixation with rotation, stop CSRF with tokens and Origin checks, enforce idle/absolute timeouts and logout revocation, detect hijack anomalies, manage concurrent devices with revoke-all, and audit the session lifecycle. Synthetic Cynarks labs only — no live-org attacks.
- Level
- Intermediate
- Duration
- 3–5 weeks
- Modules
- 4 modules · 8 lessons
- Learning method
- Lessons + labs
What you will learn
- Issue opaque high-entropy session IDs with server-side storage and expiry
- Configure HttpOnly, Secure, SameSite, and Max-Age correctly for HTTPS apps
- Rotate session IDs on login to defeat fixation
- Defend state-changing requests with CSRF tokens, SameSite, and Origin/Referer checks
- Enforce idle + absolute timeouts and server-side logout revocation
- Detect hijack anomalies and implement concurrent session revoke-all plus audit logs
Course curriculum
Expand each module for lessons, progress, and labs assigned to that module — not a flat topic dump.
Module 1
Session creation and cookie flags
Strong IDs, server stores, expiry, and production Set-Cookie attributes.
0/2 lessons
Module 1
Session creation and cookie flags
Strong IDs, server stores, expiry, and production Set-Cookie attributes.
0/2 lessons
Lessons
- 1. Session ID and Server Storepreview~20 min
- 2. Cookie Flags Combination~20 min
Enrol to unlock full lessons and track module progress.
Module 2
Fixation and CSRF defenses
Rotate on login; protect cookie-authenticated state changes.
0/2 lessons
Module 2
Fixation and CSRF defenses
Rotate on login; protect cookie-authenticated state changes.
0/2 lessons
Lessons
- 1. Session Fixation and Rotation~20 min
- 2. CSRF Tokens and Origin Checks~20 min
Enrol to unlock full lessons and track module progress.
Module 3
Timeouts and hijack detection
Idle/absolute lifetime, logout revoke, anomaly spotting.
0/2 lessons
Module 3
Timeouts and hijack detection
Idle/absolute lifetime, logout revoke, anomaly spotting.
0/2 lessons
Lessons
- 1. Idle, Absolute Timeout, and Logout~20 min
- 2. Hijack Indicators and HTTPS~20 min
Enrol to unlock full lessons and track module progress.
Module 4
Concurrent sessions and audit
Device lists, revoke-all, lifecycle and cookie policy logging.
0/2 lessons
Module 4
Concurrent sessions and audit
Device lists, revoke-all, lifecycle and cookie policy logging.
0/2 lessons
Lessons
- 1. Multi-Device Sessions and Revoke-All~20 min
- 2. Session Lifecycle and Cookie Audit~20 min
Enrol to unlock full lessons and track module progress.
Inside this course
Labs · Quizzes · Certificate
Labs below are curated for this syllabus (shared engine, course-specific assignments). They unlock with enrol; quizzes match course topics; finish ≈90%+ to claim a CYNARKS Academy certificate.
Course labs
8 assigned labs · free with this course enrol
- Session Creation & StorageUnlock via course or plan
- Cookie Flags Deep DiveUnlock via course or plan
- Session Fixation DefenseUnlock via course or plan
- CSRF Tokens & Request OriginUnlock via course or plan
- Idle, Absolute Timeout & LogoutUnlock via course or plan
- Session Hijack IndicatorsUnlock via course or plan
- Concurrent Sessions & Remote RevokeUnlock via course or plan
- Session Lifecycle Audit LogUnlock via course or plan
Track quiz
356 questions matched to this course topics
Knowledge checks for this track only — not a separate global quiz menu.
Start track quizCYNARKS certificate
Educational completion certificate · verify by ID
Your progress: 0% · enrol to unlock claim
Enrol in this course first.