Certified: SANS GIAC GSEC Audio Course

This episode teaches web session security as the practical control that determines whether authentication stays meaningful after login, which is a frequent GSEC theme in web risk questions. You’ll review cookies and bearer tokens as session carriers, then connect them to threats like theft, replay, and misuse across origins. We’ll define CSRF as forcing a victim’s browser to perform unintended actions with an active session, and explain why “the user is authenticated” does not equal “the request is legitimate.” You’ll also cover session fixation as an attack where an adversary sets or predicts a session identifier before the victim logs in, then hijacks the authenticated session after login binds to that identifier. Scenarios include missing CSRF tokens on state-changing requests, cookies without HttpOnly or Secure flags, overly broad cookie scope that leaks across subdomains, and token storage in risky client-side locations. Best practices include strong cookie flags, anti-CSRF tokens with correct validation, regenerating session identifiers at authentication boundaries, short lifetimes with rotation where appropriate, and server-side invalidation on logout and credential changes. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.