‫Session related issues.
‫So cookies are used to implement session management for Web applications.
‫In order to avoid attacks against session management, an application should have a good cooking policy
‫because the session ID that identifies the user is carried in the cookie.
‫That's why cookies are so very important to an application, my.
‫So now let's talk about the session ID value that is transported in the cookies, the session ID represents
‫the user, so after the user logs into the application, it is as important as a login data itself.
‫Username and password.
‫A session ID value should be unique, random, unpredictable, and long enough so these properties can
‫make the session ID resistant to session analyzing and brute force attacks.
‫But often, very often this is not enough for protection.
‫The application should transport the session value in a safe way, such as https.
‫So now we have a session ID value that is transported safely and it's strong against attacks.
‫But the last thing is that a session ID should also have a lifetime.
‫I mean, this is absolutely true.
‫Assessing value should be created and live until a certain time.
‫That's why this session ID should have an expiration date.
‫So in general, for a session ID values, if the expiry date is not set, the season well lasts until
‫the browser is closed and if it's directly set in the session, ID will be stored in the browser until
‫the expiry date.
‫So spend Testa's.
‫We should check all of these properties and then report all of those findings about the insecure session
‫ID values.