We Fight for the User's… Session

Mark Hoopes traces the history of browser cookies and the attacks aimed at them, framing session tokens as something that needs active defense. He walks through the main routes to theft: network interception, script injection, cross-site request forgery and misuse after a token is already stolen. For each, he reviews the protections available, including the secure and HttpOnly flags, HSTS and its preload list, SameSite defaults and frame-ancestors.

The middle section covers the pushback developers give when these flags are proposed. He argues that HttpOnly is often unnecessary for single page applications, since the browser attaches cookies to API calls without scripts reading them. He suggests mapping session lifetimes on a timeline so stakeholders see how long a stolen token remains usable, and cautions that JWTs with fixed expiry keep working after logout unless the server tracks revocation.

The final part covers Google's proposed Device Bound Session Credentials. He traces the earlier token binding effort that stalled because application code could not easily reach TLS key material, then describes how DBSC ties a session to a key held in the device's TPM, with short-lived cookies the browser refreshes itself. He notes current limits, including HTTPS requirements, Chrome-only flags and difficult debugging, and argues that framework support will decide adoption and that the approach could undercut infostealer-driven session theft.