Lion Cipher Lab

Harden session cookies and stop session fixation

• Identity & Access Management
• Intermediate
• ~75 min
• Free · no account required

Why it matters

Almost every web app you will ever secure hands a browser a session cookie the moment you log in, and that cookie IS your identity for the rest of the visit. If the id inside it can be stolen by a script, planted before you log in, or replayed forever, the whole login was pointless. The two cheapest, highest-impact fixes in web security live here — rotate the id on login, and set three attributes on the cookie — yet they are skipped constantly. Knowing exactly what each one does, and what it does NOT do, is core identity-and-access knowledge and a very common interview topic.

What you'll learn

• reading a session cookie in browser DevTools (Application -> Cookies) and in raw `curl -i` output, and spotting when it carries NO security attributes
• explaining the difference between a session IDENTIFIER (an opaque id in a cookie that points at server-side state) and the CSRF token / JWT problems, so you know which lab solves which threat
• demonstrating a session-fixation attack end to end with curl cookie jars: an attacker plants a pre-login session id, the victim authenticates on it, and the attacker inherits the logged-in session
• fixing fixation the only reliable way — regenerating (rotating) the session id at the moment of privilege change (login) and invalidating the pre-login id server-side
• setting and VERIFYING the cookie attributes that each address a different threat: HttpOnly (blunts XSS cookie theft), Secure (HTTPS-only), and SameSite=Lax/Strict (CSRF defense-in-depth)
• using the __Host- cookie name prefix and stating exactly what the browser enforces because of it (Secure, Path=/, no Domain)
• adding idle and absolute session timeouts and server-side invalidation on logout, instead of trusting the cookie to expire itself
• making the judgment calls: why HttpOnly does NOT stop CSRF, why Secure/SameSite do NOT stop XSS, why cookie flags alone do NOT fix fixation, and why a server-side store with a short TTL beats a fat client-side cookie

Steps in this lab

1. What a session cookie is — and what this lab is (and is not)
2. Set up Python, Flask, and the lab folder
3. Build the VULNERABLE app and see the naked cookie
4. What session fixation is, before you do it
5. Exploit the fixation bug with curl
6. Fix fixation the only reliable way: rotate the id on login
7. Build the HARDENED app: rotation + all the cookie flags + timeouts
8. Prove the fix: re-run the attack, then verify every flag
9. Judgment: which control stops which threat (and what none of them do)

Open the full interactive lab →