Session Security

Content Type: Module

Categories: Utility,User Interface

Overview

The Session Security Module enhances application security by protecting against session hijacking, replay attacks, and unauthorized access using a layered validation approach.

It combines:

Device token tracking
Request fingerprinting
Session validation
Rate limiting
Identity verification flows

Documentation

Overview

The Session Security Module enhances application security by protecting against session hijacking, replay attacks, and unauthorized access using a layered validation approach.

It combines:

Device token tracking
Request fingerprinting
Session validation
Rate limiting
Identity verification flows

Key Features

Device Token Management

Generates a secure random device token
Stored in HttpOnly, Secure cookies
Enables persistent device recognition

Device Fingerprinting

Built using:
- User-Agent
- IP Address
- Accept-Language
Detects suspicious session/environment changes

Session Validation

Validates device + session on every request
Detects hijacked or reused sessions

Rate Limiting

Multi-layer protection:
- IP-based
- Session-based
- Fingerprint-based

Identity Verification Layer

Supports:
- Device-based verification
- Token-based validation
- Fallback verification without token

Forced Logout

Immediate session invalidation
Useful for suspicious activities

Module Components

Java Actions

Action Name	Description
`GenerateAndSetDeviceToken`	Generates device token and sets secure cookie
`GetCurrentDeviceFingerPrint`	Generates fingerprint from request
`GetDeviceTokenFromRequest`	Extracts device token from cookie
`GetCurrentCookieToken`	Retrieves cookie token
`GetSessionId`	Returns current session ID
`GetUserIP`	Retrieves user IP
`ForceLogoutSession`	Terminates session
`RateLimitation_IP_Fingerprint_Session`	Advanced rate limiting
`RateLimitationSessionBased`	Session-based rate limiting

Logics

Logics	Description
`ACT_Login`	Secure login entry point with validation
`SUB_SetDeviceTokeninCookieAndDB`	Stores device token in cookie and database
`SUB_VerifyUserIdentity`	Validates user using device token + fingerprint
`SUB_VerifyUserIdentity_WithoutToken`	Handles users without device token (new device scenario)
`SUB_RateLimitation_fingerprint`	Fingerprint-based rate limiting
`SUB_RateLimitation_Session`	Session-based rate limiting
`SUB_Sample`	Example implementation flow

Login:

Use the nanoflow ACT_LoginViaMicroflow to automatically configure the session security and To validate use SUB_VerifyUserIdentity_WithoutToken or any verify microflow.