My friend who is a web developer implemented his session management in a totally new way for me.

He created a random sessionAPPID that is given to the user when he gives correct credentials.

He then created a HTTP header that has this form:

APPID: sessionAPPID 79299291724

He stores the sessionAPPID in the backend and verifies it on every request. At this point everything is normal apart from the fact that he could have used bearers instead of creating a custom HTTP header.

What seems weird for me is that he stores the sessionAPPID in the cookie:

cookie: sessionAPPID=79299291724

He does not even compare his sessionAPPID in the custom header to the one in the cookie (verification with the one in the backend only).

When a user needs to logout he just clears his local cookie and does not delete it from the backend. When the user log in again he is given another random sessionAPPID.

I told him to just clear the sessionAPPID from the backend but he said it useless because there is an expiration date.

I told him that if an attacker steals the cookie it is dangerous because he can use the sessionAPPID. He said that everything is on HTTPS so no one can intercept it...

How can I give him a good Proof Of Concept of what he is doing is unsecure ? I mean beside mentioning the OWASP broken authentication and Insufficient Logging and monitoring I am not aware of any attack that can exploit this (not on portswigger academy at least).

  • There are many unclear points in your question. Please explain them. Otherwise it is impossible to answer your question.
    – mentallurg
    Commented Feb 23, 2023 at 19:57
  • 2) Where and how is the header sessionAPPID used? Where and how the cookie sessionAPPID is used?
    – mentallurg
    Commented Feb 23, 2023 at 20:01
  • 3) What is the purpose of setting both header sessionAPPID and cookie sessionAPPID?
    – mentallurg
    Commented Feb 23, 2023 at 20:01
  • 2- When you send a request (GET or Post...) you need to have the sessionAPPID a valid one in the header otherwise you will be unauthorized @mentallurg
    – rudeus123
    Commented Feb 23, 2023 at 20:04
  • 1
    "you need to have the sessionAPPID a valid one in the header" - Then write this to the question. Also write, what side is responsible for setting the header. From the current question it looks like the server sets the header. Also please explain how the client obtains the value for this header.
    – mentallurg
    Commented Feb 23, 2023 at 20:08

1 Answer 1


Given that the session ID is somehow added as custom header, JavaScript must have access to the session ID. Thus, an XSS vulnerability can exfiltrate the session ID. My suggestion would be to try and find an XSS vulnerability (preferably stored, but reflected works too).

Afterwards, you can log in with the stolen session.

All in all, the scheme is not best practice, but it's also not totally busted.

  • I think an XSS is a little bit dead because I told him to use angularJS with the user input sanitizer and he did in fact use it ...
    – rudeus123
    Commented Feb 23, 2023 at 19:49
  • This is a comment. This does not answer the question.
    – mentallurg
    Commented Feb 23, 2023 at 20:04
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Feb 23, 2023 at 21:38
  • @mentallurg The question was "How can I write a PoC?" and the answer is "Find an XSS vulnerability to exfiltrate the session data". If you consider this insufficient, please tell me how the answer could be improved.
    – Frittata
    Commented Feb 24, 2023 at 2:02
  • 1
    "to try and find an XSS vulnerability" - this is way too abstract.
    – mentallurg
    Commented Feb 24, 2023 at 7:30

Not the answer you're looking for? Browse other questions tagged .