Member Avatar for saif_15

Do you know how to make user sessions secure on your web app or mobile app?

  • 2 Contributors
  • 2 Replies
  • 194 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Dani

Dani AI

Generated

raised the right concern; correctly called out encrypted transport but that’s only the first layer. Session security combines strong transport, safe token storage/exchange, lifecycle controls (short lifetimes, rotation, revocation), and defenses against client-side attacks. The points below focus on practical, low-friction controls you can apply to web and mobile sessions. (cheatsheetseries.owasp.org)

On the web, treat the session identifier as the full equivalent of a credential: generate it with a CSPRNG, keep session state server-side, and avoid URL-based IDs. Exchange it in cookies with Secure + HttpOnly and an appropriate SameSite value (use __Host- prefix when possible). Always regenerate the session ID after login/privilege changes, enforce idle and absolute timeouts, add strict cache-control (no-store) to sensitive responses, and provide server-side logout + session listing for users/admins. (cheatsheetseries.owasp.org)

Protect tokens from XSS/CSRF: do not persist access tokens in localStorage or other JS-accessible stores if you can avoid it. For SPAs consider the cookie-to-header pattern or a short-lived in-memory token and a CSRF synchronizer or same-site defenses for state-changing actions. Implement refresh-token rotation and a revocation endpoint so stolen refresh tokens can be invalidated. (cheatsheetseries.owasp.org)

Mobile apps need platform-specific handling: use the OAuth Authorization Code flow with PKCE and an external browser/session API (avoid embedded webviews), and store long-lived secrets only in platform-secure storage (iOS Keychain, Android Keystore). Consider certificate pinning only when you control both client and server and have an operational plan for pin rotation. Also log and monitor device sessions so users can revoke lost-device sessions. (rfc-editor.org)

Quick checklist

  • TLS everywhere + HSTS.
  • Secure, HttpOnly, SameSite cookies; regenerate IDs on auth.
  • Short idle + absolute timeouts; no URL session IDs.
  • Avoid localStorage for tokens; use Keychain/Keystore on mobile.
  • Use PKCE and external browser auth for native apps.
  • Implement refresh-token rotation, revocation endpoint, and session dashboard for users/admins.

Troubleshooting note: when sessions fail across environments, first verify mixed HTTP/HTTPS requests, cookie attributes (Domain/Path/SameSite), and server-side session-store connectivity before changing token logic.

Recommended Answers

All 2 Replies

Member Avatar for Dani

You mean by using an SSL certificate so that the website is accessible via https:// and not just via http:// ??

commented: Not exactly SSL, if any user looged in the web/mobile app How Can I make sure secure session of our logged in users? +0
Member Avatar for Dani

On the web, it’s done with SSL. I don’t know enough about mobile apps to know about how their security works.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.