CS KAIROS · LEARNING LIBRARY
M11 · Session Hijacking · Safe practice
This module uses offline data, self-created inputs or tabletop scenarios. Follow the steps and check the evidence you produce.
Tabletop exercise: draw session states
Use paper and fictional identifiers S1 and S2. Do not read real cookies.
- Draw logged out, S1 active, logout requested and S1 invalid.
- Add a branch renewing the identifier to S2 after a privilege change.
- Mark the step that needs server-side evidence.
Expected result
Invalidation needs evidence that the server rejects the old identifier; returning to a login screen is insufficient.
Check your work
Does HttpOnly guarantee that injected scripts cannot send any requests as the user?
Finish and clean up
Keep the state diagram. No real sessions need clearing.