Skip to content

Chapter 5 of 6

Session Management, Secrets, and Rate Limiting

Sessions, secrets, and rate limits form the operational backbone of a secure application. Secure session management begins with generating session identifiers using a cryptographically secure random number generator so that IDs cannot be guessed or predicted. Cookies that carry these identifiers must be marked HttpOnly (so JavaScript cannot read them, mitigating XSS theft), Secure (so they only travel over HTTPS), and SameSite (so they are not sent on cross-site requests). Best practice also calls for both idle and absolute session timeouts, regeneration of the session ID immediately after a successful login to prevent session fixation attacks, and proper invalidation on logout. Storing actual session data on the server rather than inside the cookie itself makes revocation and anomaly detection far easier.

Secrets management addresses the everyday reality of API keys, database passwords, certificates, and tokens that an application needs to function. The cardinal rule is to never hardcode secrets into source code or commit them to a public repository. Instead, applications should retrieve secrets at runtime from environment variables or, better, from a dedicated vault such as HashiCorp Vault or AWS Secrets Manager. Secrets should be rotated regularly, access to them should be audited, and configuration files containing them should be excluded through .gitignore. The same discipline applies to API keys specifically: they should never be embedded in client-side code, should be scoped to the minimum permissions required, should have expiration dates, and should differ between development and production. Separate keys per environment also make it easier to revoke one without disrupting everything else, and usage monitoring can spot anomalies that suggest a key has leaked.

Rate limiting protects applications and APIs from abuse by restricting how many requests a client can make within a given time window. It defends against brute-force login attempts, distributed denial-of-service attacks, and unfair usage, and overloaded servers respond with HTTP 429 Too Many Requests and a Retry-After header telling the client when to try again. Several algorithms are in common use: the fixed-window counter resets on a schedule, the sliding window smooths traffic across boundaries, and the leaky bucket drains requests at a steady rate. The token bucket variant is especially popular because it allows brief bursts up to the bucket's capacity while smoothing long-term rate, with tokens added at a fixed rate and each request consuming one; if the bucket is empty, the request is rejected. Services such as AWS API Gateway and Stripe use this approach because it strikes a good balance between simplicity, fairness, and the ability to absorb legitimate spikes.

All chapters
  1. 1The OWASP Top 10 and Web Application Threats
  2. 2Cryptography: Securing Data in Transit and at Rest
  3. 3Authentication, Authorization, and Identity Protocols
  4. 4Browser Security Mechanisms and HTTP Headers
  5. 5Session Management, Secrets, and Rate Limiting
  6. 6Security Principles and Defensive Design

Drill it

Reading is not remembering. These come from the Software Security deck:

Q

What is the OWASP Top 10?

The OWASP Top 10 is a regularly updated list of the most critical web application security risks. The 2021 edition includes: A01: Broken Access ControlA02: Cryp...

Q

What is Cross-Site Scripting (XSS)?

XSS is a vulnerability where an attacker injects malicious scripts into web pages viewed by other users. Three types: Reflected: script in URL is reflected back...

Q

What is reflected XSS?

Reflected XSS occurs when user input from a request is immediately included in the response without proper encoding. Example: a search page that displays the qu...

Q

What is stored XSS?

Stored XSS (persistent XSS) occurs when malicious script is saved on the server (e.g., in a database, forum post, or comment) and served to users who view that...