Help us improve
Share bugs, ideas, or general feedback.
From prodsec-skills
Reviews session management and cookie security: ID generation, cookie flags, rotation, timeouts, theft detection, and client-side storage restrictions.
npx claudepluginhub redhatproductsecurity/prodsec-skills --plugin prodsec-skillsHow this skill is triggered — by the user, by Claude, or both
Slash command
/prodsec-skills:session-management-cookiesThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Implement robust, attack-resistant session handling that prevents fixation, hijacking, and theft while maintaining usability.
Implements secure session management with cryptographically random tokens, HttpOnly/Secure/SameSite cookies, and timeout enforcement to prevent hijacking and fixation.
Guides session token generation, cookie security configuration, timeout policies, and revocation to prevent hijacking and fixation attacks.
Implement secure session handling with proper token generation, storage, expiry, CSRF protection, and session invalidation.
Share bugs, ideas, or general feedback.
Implement robust, attack-resistant session handling that prevents fixation, hijacking, and theft while maintaining usability.
id) rather than framework defaults. Reject any incoming ID not created by the server.Secure, HttpOnly, SameSite=Strict (or Lax if necessary for flows) on session cookies.Path and Domain. Avoid cross-subdomain exposure.Example header:
Set-Cookie: id=<opaque>; Secure; HttpOnly; SameSite=Strict; Path=/
Cache-Control: no-store on responses containing session identifiers or sensitive data.sec-ch-ua where available).localStorage/sessionStorage due to XSS risk. Prefer HttpOnly cookies for transport.Secure, HttpOnly, SameSite set; tight domain/pathCache-Control: no-store for sensitive responsesSecure, HttpOnly, and SameSite flags are present on all session cookies.