Overview

The Session Security Module enhances application security by protecting against session hijacking, replay attacks, and unauthorized access using a layered validation approach.

It combines:

• Device token tracking
• Request fingerprinting
• Session validation
• Rate limiting
• Identity verification flows

Documentation

Overview

The Session Security Module enhances application security by protecting against session hijacking, replay attacks, and unauthorized access using a layered validation approach.

It combines:

• Device token tracking
• Request fingerprinting
• Session validation
• Rate limiting
• Identity verification flows

Key Features

 Device Token Management

• Generates a secure random device token
• Stored in HttpOnly, Secure cookies
• Enables persistent device recognition

Device Fingerprinting

• Built using:
  1. User-Agent
  2. IP Address
  3. Accept-Language
• Detects suspicious session/environment changes

Session Validation

• Validates device + session on every request
• Detects hijacked or reused sessions

 Rate Limiting

• Multi-layer protection:
  1. IP-based
  2. Session-based
  3. Fingerprint-based

Identity Verification Layer

• Supports:
  1. Device-based verification
  2. Token-based validation
  3. Fallback verification without token

 Forced Logout

• Immediate session invalidation
• Useful for suspicious activities

Module Components

Java Actions

Logics

Login:

Use the nanoflow ACT_LoginViaMicroflow to automatically configure the session security and To validate use SUB_VerifyUserIdentity_WithoutToken or any verify microflow.