Lion Cipher Lab
Build a server-side session manager: idle and absolute timeouts, a 'your devices' list, and sign-out-everywhere
- Identity & Access Management
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Every 'Where you're signed in' page, every 'sign out of all devices' button, and every 'your password was changed, please log in again' email sits on top of a session manager like the one you build here. When it is missing or naive, a password change leaves the attacker's stolen cookie working, a leaked database backup hands out live logins, and a session used all day never ends. In this lab you measure each of those failures, fix it, and measure the fix: 3 of 3 old cookies survive a naive password change and 0 of 3 survive the hardened one, 100 of 100 dumped raw tokens work and 0 of 100…
What you'll learn
- Designing a server-side session store keyed by the SHA-256 of an opaque token, so a leaked copy of the table yields no usable cookies
- Enforcing idle and absolute timeouts on the server, and testing them in milliseconds with an injected fake clock
- Choosing timeout numbers from NIST SP 800-63B-4 (per AAL) and the OWASP Session Management Cheat Sheet
- Building a 'your active sessions' page with revoke-one and sign-out-everywhere-else that cannot touch another user's sessions
- Revoking every session on password change and MFA reset while keeping the current device signed in on a fresh token
- Comparing evict-oldest and reject-newest per-user session caps, and the lockout each one risks
- Throttling last_seen writes and measuring both the writes saved and the timeout accuracy it costs
- Gating sensitive actions on how old auth_time is, and storing device metadata in coarse, privacy-minimized form
Steps in this lab
- What a session manager is, and where this lab sits
- Server-side sessions or stateless JWTs: decide before you build
- Set up a workspace
- Build sessions.py: hashed tokens, minimal metadata, server-side rules
- Save measure.py and measure the timeouts
- Measure what a leaked sessions table is worth
- Measure who survives a password change and an MFA reset
- Measure the devices page, revoke-one, and sign-out-everywhere-else
- Measure a per-user session cap: evict oldest vs reject newest
- Measure the write savings from throttled last_seen updates
- Measure re-authentication for sensitive actions
- Run it as a real web app and replay a stolen cookie
- Privacy: store the least device data that still lets a user recognize a device
- Honest limits, and how a pro does it differently