Cookie flags and session fixation: what we still find in 2026

During hardening advisory calls, session design still earns more whiteboard time than exotic cryptography. The failures are ordinary—and still shipping.

Missing Secure and HttpOnly

Teams enable HTTPS at the edge and forget to set cookie attributes in the application. An advisory brief that only says “use HTTPS” misses the concrete attribute checklist developers need.

Session identifiers that survive login

If the identifier issued before authentication remains valid after login, fixation becomes practical. We ask teams to regenerate identifiers at privilege change and to document where that regeneration lives in the codebase.

Idle timeout versus absolute timeout

Product wants long idle windows; security wants absolute caps for privileged roles. The advisory outcome is usually a split policy: longer idle for low-privilege sessions, shorter absolute lifetime for admin tokens.

What to bring to an advisory session

A sequence diagram of login, refresh, and logout—and the actual cookie-setting code. Without those, the conversation stays theoretical.