Group
  • Security

    Add session expiration and rotation

    Makes sessions expire, rotate after login and privilege changes, and die on logout on the server side.

    • Improve quality
    • Intermediate
    • General

Free Prompt

Review my app's session lifecycle and fix the gaps. Look at session creation, how long sessions live, what happens on login and logout, and what happens when a user changes their password or email. Implement these behaviors: sessions expire after a defined idle period and have an absolute maximum lifetime; a new session identifier is issued after login and after any privilege change (password change, email change, role change) to prevent session fixation; logout destroys the session server-side, not just in the browser; and there's a way to invalidate all sessions for one user (needed after a password reset or suspected compromise). Do not change the login UI or add third-party session services. Use the session mechanism already in the project. Keep the expiration defaults reasonable for a consumer app (days, not minutes) so users aren't logged out constantly. Show me each change with the reasoning. End with verification steps: how to confirm a session dies after logout by replaying the old token, and how to confirm the session identifier changes after login.

What This Does / How This Helps

Gives your sessions a real lifecycle: they expire, they rotate to a fresh identifier after login and privilege changes, and logout actually kills them on the server instead of just clearing the browser. Sessions that live forever are a liability. If a token ever leaks (stolen laptop, logged request, shared screen), an attacker keeps access indefinitely. Rotation after login also shuts down session fixation, where an attacker plants a known session ID and waits for a victim to log in with it. Expect each change explained, plus replay tests you can run to prove an old token is dead after logout.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts