A network session is a sequence of requests and response transactions associated with the same user. Sessions provide the ability to establish variables, such as access rights and localization settings, that will apply to each interaction a user has with the web application for the duration of the session. Web applications, for example, can create sessions to keep track of logged on users after the login process. This ensures the ability to identify the user on any subsequent requests as well as allows for applying access security controls, authorizing access to the user's private data, and increasing the usability of the application. Vulnerabilities in this category are related to the creation, tracking, and disposal of the session identifiers. By mismanaging the session handling, an attacker can guess or reuse a session key/ID and take over the session and the identity of a legitimate user.

Common attacks associated with session management vulnerabilities include:

• Session hijacking
• Session replay
• Man-in-the-middle attacks

Make sure that you use proper session handling techniques, adhering to best practices such as random session (key) generation, proper session tracking, and adequate finalization of sessions. Add user-unique values to a session key to minimize the risk of interception and reuse of session keys.