← Back to Projects
Business Systems House 2026
Enterprise Web Application Session Security & Anti-CSRF Rules
HTTP Cookies SameSite HttpOnly Anti-CSRF Tokens IIS WebLogic Security Headers
Enterprise Web Application Session Security & Anti-CSRF Rules
Hardened web application session handling to protect user accounts against cross-site request forgery (CSRF) and session hijacking.
Key Features & Implementation
- Session Cookie Flag Hardening: Configured web application servers to append Secure, HttpOnly, and SameSite=Strict flags to all session cookies.
- Anti-CSRF Token Enforcement: Validated cryptographic anti-CSRF request tokens on all state-changing HTTP POST form submissions.
- Automated Session Invalidation: Configured strict idle session timeouts and client-side session destruction upon logout.