home / skills / jeremylongshore / claude-code-plugins-plus-skills / checking-session-security

checking-session-security skill

needs review

/plugins/security/session-security-checker/skills/checking-session-security

This skill helps you audit session management for web apps, identifying fixation risks, misconfigurations, and insecure defaults to improve security posture.

npx playbooks add skill jeremylongshore/claude-code-plugins-plus-skills --skill checking-session-security

Review the files below or copy the command above to add this skill to your agents.

Files (10)

SKILL.md

2.3 KB

---
name: checking-session-security
description: |
  Analyze session management implementations to identify security vulnerabilities in web applications.
  Use when you need to audit session handling, check for session fixation risks, review session timeout configurations, or validate session ID generation security.
  Trigger with phrases like "check session security", "audit session management", "review session handling", or "session fixation vulnerability".
  
allowed-tools: Read, Write, Edit, Grep, Glob, Bash(code-scan:*), Bash(security-check:*)
version: 1.0.0
author: Jeremy Longshore <[email protected]>
license: MIT
---

# Checking Session Security

## Overview

This skill provides automated assistance for the described functionality.

## Prerequisites

Before using this skill, ensure:
- Source code accessible in {baseDir}/
- Session management code locations known (auth modules, middleware)
- Framework information (Express, Django, Spring, etc.)
- Configuration files for session settings
- Write permissions for security report in {baseDir}/security-reports/

## Instructions

1. Review session creation, storage, and transport security controls.
2. Validate cookie flags, rotation, expiration, and invalidation behavior.
3. Identify common attack paths (fixation, CSRF, replay) and mitigations.
4. Provide prioritized fixes with configuration/code examples.


See `{baseDir}/references/implementation.md` for detailed implementation guide.

## Output

The skill produces:

**Primary Output**: Session security report saved to {baseDir}/security-reports/session-security-YYYYMMDD.md

**Report Structure**:
```
# Session Security Analysis Report
Analysis Date: 2024-01-15
Application: Web Portal
Framework: Express.js

## Error Handling

See `{baseDir}/references/errors.md` for comprehensive error handling.

## Examples

See `{baseDir}/references/examples.md` for detailed examples.

## Resources

- Session Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html
- OWASP Top 10 - Broken Authentication: https://owasp.org/www-project-top-ten/
- NIST 800-63B Authentication: https://pages.nist.gov/800-63-3/sp800-63b.html
- PCI-DSS Session Requirements: https://www.pcisecuritystandards.org/
- Express.js Session Security: https://expressjs.com/en/advanced/best-practice-security.html

Overview

This skill audits web application session management to find security weaknesses and recommend fixes. It inspects session creation, storage, transport, and lifecycle policies to produce a prioritized report with actionable remediation steps. The output is a dated session security analysis saved to the project security-reports folder.

How this skill works

The skill scans authentication and middleware code paths to locate session handling logic, configuration files, and cookie settings. It validates secure cookie flags, session ID generation, rotation and invalidation behavior, timeout configuration, and storage hardening. It enumerates attack paths such as session fixation, replay, and CSRF-related session misuse, then generates prioritized code and configuration fixes.

When to use it

Before a release to validate session handling after feature changes
During security reviews or penetration testing preparation
When moving between frameworks or refactoring auth/session code
If you suspect session fixation, hijacking, or abnormal session behavior
To validate compliance with OWASP and compliance requirements

Best practices

Enforce Secure, HttpOnly, SameSite cookie flags and use TLS-only transport
Rotate session IDs after authentication and on privilege changes
Set short idle and absolute session timeouts with server-side invalidation
Store minimal data in sessions and prefer server-backed stores with access controls
Validate session ID entropy and avoid predictable generators or weak libraries
Log and monitor session anomalies and implement proactive invalidation

Example use cases

Audit an Express.js app to ensure cookies use Secure and HttpOnly flags and session IDs rotate after login
Review a Django deployment to confirm SESSION_COOKIE_AGE, SESSION_EXPIRE_AT_BROWSER_CLOSE, and storage backend are safe
Check a Java/Spring app for session fixation risks and missing session invalidation on logout
Prepare a remediation plan with code snippets and configuration changes for a corporate web portal
Create a compliance-ready report citing OWASP and NIST guidance for auditors

FAQ

What files or locations does the skill need access to?

Provide source code access for auth modules, middleware, and configuration files so the skill can locate session handling and cookie settings.

What does the generated report contain?

A dated analysis with findings, prioritized fixes, example code/config snippets, and references to OWASP, NIST, and framework guidance.