Engineering

Session Management Review Prompt

Review the session lifecycle for the classic holes — fixation, weak expiry, missing rotation, insecure cookies, and sessions that outlive a logout or password change.

Open in Code Review Prompt Generator

Overview

Sessions are where auth quietly breaks: a token that never expires, a session that survives a password reset, a cookie missing HttpOnly. This prompt reviews the session lifecycle end to end — creation, storage, expiry, rotation on privilege change, invalidation on logout and password change, and cookie security — against the well-known failure modes.

How to use this resource

Gather the session lifecycle code

Collect the code that creates, stores, expires, and invalidates sessions, plus the cookie settings. The review walks the lifecycle end to end.
Open this resource in Code Review Prompt Generator

Load the prompt into Code Review Prompt Generator and paste in the session code. It reviews for fixation, weak expiry, missing rotation, and insecure cookies.
Review the session findings

Read each finding - a session that outlives a logout or password change, a token that never expires, a cookie missing HttpOnly - against the known failure modes.
Fix the holes and re-review

Close the flagged issues, especially rotation on privilege change and invalidation on logout, then re-run the review to confirm the lifecycle is tight.

Why This Works

The session lifecycle is where most real auth bugs live
A checklist catches the invalidation-on-password-change gap teams routinely miss
Cookie-flag and fixation checks are cheap to run and expensive to skip

Best for

Any app with logged-in sessions
Code after an auth change or library upgrade
Apps handling sensitive accounts

Not for

Choosing the auth mechanism — use the Authentication Strategy Prompt
Reviewing JWT-specific issues — use the JWT Security Review Prompt

Use cases

Reviewing session handling before a release
Checking that sessions die on logout and password change
Auditing cookie flags and session expiry

FAQ

How does an AI session review flag which issues are most serious

The SEVERITY section tags each finding [CRITICAL], [MAJOR], or [MINOR], and states that sessions surviving a password reset, or fixation, are CRITICAL. Code Review Prompt Generator produces this review prompt; you run it in your own assistant. Treat the output as a review to verify, not a security audit or a guarantee that every session hole was caught.

What session lifecycle stages does this prompt actually check

Seven, walked in order: FIXATION (fresh ID on login), EXPIRY (absolute and idle timeout), ROTATION on privilege change, INVALIDATION on logout and password change, STORAGE safety, COOKIE FLAGS, and CONCURRENCY including log out everywhere. It reviews the lifecycle code you paste and returns findings with locations; confirming and fixing them stays your responsibility.

When should I use the JWT review instead of this session prompt

Use a JWT-specific review for token-signature and claims issues; the notFor sends you to the JWT Security Review Prompt for those. This one targets the server-side session lifecycle instead, checking INVALIDATION on logout and where STORAGE lives. Choosing the auth mechanism is also out of scope, and the output is a review recommendation, not a validated sign-off.

Customize This Resource

Opens this setup in Code Review Prompt Generator. Generate to get the full review contract — then adjust the focus, scope, language, and style.

Open in Code Review Prompt Generator

Prompt Template

Copy it as-is, or use Open in Code Review Prompt Generator to load it pre-filled and customize it with your own context.

ROLE
You are reviewing how an application manages sessions, for security flaws across the session lifecycle.

INPUT
[Paste the session/auth code: creation, storage, middleware, logout, cookie config]

REVIEW THE LIFECYCLE
1. FIXATION: is a fresh session ID issued on login (not reusing a pre-auth one)?
2. EXPIRY: do sessions have an absolute and idle timeout — not effectively infinite?
3. ROTATION: is the session rotated on privilege change (login, role elevation)?
4. INVALIDATION: is the session destroyed server-side on logout, and invalidated on password change/reset?
5. STORAGE: where session state lives, and whether it's safe (no sensitive data in a client-readable token).
6. COOKIE FLAGS: HttpOnly, Secure, SameSite set appropriately?
7. CONCURRENCY: how concurrent sessions and 'log out everywhere' are handled.

SEVERITY
Tag findings [CRITICAL]/[MAJOR]/[MINOR]. Sessions that survive a password reset, or fixation, are CRITICAL.

OUTPUT
Findings by severity with exact locations. Findings only.

More resources from Code Review Prompt Generator

Resource

Code Review Prompt — the Review Contract

"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.

Prompt Engineering

Resource

Security Code Review Prompt

Twelve security checks — injection, auth, secrets, SSRF, privilege escalation — reviewed the way an attacker would read the code.

Engineering

Resource

API Review Checklist Prompt

Architecture review for the public surface: abstractions that earn their place, dependency direction, seams, and the patterns the codebase already has.

Engineering

Resources that pair well

Resource

Refactor Prompt — the Behavior Preservation Contract

"Refactor this code" invites silent behavior changes. The refactoring contract preserves business rules, outputs, and side effects — and flags uncertainty instead of deciding it.

Prompt Engineering

Resource

Playwright Test Prompt

getByRole over CSS chains, auto-wait over sleep, web-first assertions — Playwright tests written the way Playwright wants.

Engineering

Resource

Compare Two ChatGPT Prompts

A side-by-side way to decide between two ChatGPT prompt drafts — scored on clarity, specificity, output control, and risk instead of gut feeling.

Prompt Engineering

Related tools

Tool

Code Review Prompt Generator

Generate code review prompts for any scope — snippet, file, diff, or full pull request — with focused review rules.

Coding Workflows

Guides for this resource

Guide

How to Review Authentication Code With AI Without Missing Common Flaws

Four hundred lines of login code and a yes-or-no. You can read every line, find nothing, and still be wrong — because what will hurt you is in the file nobody opened alongside it: a session that outlives a logout, a reset that leaves the old one working.

Software Development with AI

Tip: Save time by exploring related resources and tools that integrate with this resource.