← all checklists

Sessions, Tokens & Cookies

21 items · source

Copy as markdown

Filter items

Session / Token Security

• Verify expiration.
• Verify issuance.
• Verify rotation.
• Verify revocation.
• Verify replay resistance.
• Verify audience.
• Verify issuer.
• Verify signing algorithm.
• Verify signing key.
• Verify key rotation.
• Verify token type separation.
• Verify access token vs refresh token separation.
• Verify user session vs service account token separation.
• Verify token scope.
• Verify token storage.
• Verify token leakage through URLs.
• Verify token leakage through logs.
• Verify token leakage through browser history.
• Verify token leakage through referrer headers.
• Verify token leakage through analytics.
• Verify token leakage through crash reporting.