Agent skill · security · jeremylongshore
checking-session-security
Analyze session management implementations to identify security vulnerabilities
Why this skill is useful
Provides detailed auditing procedures and security checks for session management vulnerabilities that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Checking Session Security Overview Audit session management implementations in web applications to identify vulnerabilities including session fixation (CWE-384), insufficient session expiration (CWE-613), and cleartext transmission of session tokens (CWE-319). Prerequisites Application source code accessible in ${CLAUDESKILLDIR}/ Session management code locations identified (auth modules, middleware, session stores) Framework and language identified (Express.js, Django, Spring Boot, Rails, ASP.NET, etc.) Session configuration files available (session.config., settings.py, application.yml) Write permissions for reports in ${CLAUDESKILLDIR}/security-reports/ Instructions 1. Locate session management code by searching for patterns: /auth/, /session/, /middleware/, and framework-specific files (settings.py, application.yml, web.config). 2. Analyze session ID generation: verify use of a cryptographically secure random generator with at least 128 bits of entropy. Flag predictable patterns such as Date.now(), Math.random(), sequential IDs, or timestamp-based tokens (CWE-330). 3. Check session fixation protections: confirm the session ID is regenerated after authentication (req.session.regenerate() in Express, request.session.cyclekey() in Django). Flag any login handler that sets authenticated = true without regenerating the session ID. 4. Validate cookie security attributes: verify HttpOnly (prevents XSS-based token theft), Secure (HTTPS-only transmission), SameSite=Lax Strict (CSRF mitigation), and Host-/Secure- prefix usage. Flag any missing attribute. 5. Review session expiration: check idle timeout (recommend 15-30 min for sensitive apps), absolute timeout (recommend 4-8 hours), and sliding window configuration. Flag sessions without any expiration. 6. Audit session invalidation: verify logout handlers destroy server-side session state and clear client cookies. Confirm password reset and privilege escalation flows invalidate existing sessions. 7. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/checking-session-security--9820b3