- Lab
- Security
Secure Session Management for C# Applications
In this lab, you’ll practice modern session management and authentication techniques in ASP.NET Core. You’ll begin with a brief concept of secure session cookies and JSON Web Tokens (JWT). Then, you’ll create a weak cookie-based session, enhance it (Secure flag, HttpOnly, SameSite, short idle timeout), and finally transition to JWTs—learning to issue, validate, and rotate access tokens statelessly.
Path Info
Table of Contents
-
Challenge
Getting Started in the Lab Environment
Here are the initial instructions and explanation of the lab environment. Read this while your environment is busy creating itself from nothing. Yes, this violates physics; we know. How fun!
-
Challenge
The Foundations of Secure Session Management and Token-Based Authentication
Before diving into coding, review the threats that session cookies and tokens need to defend against, including session fixation, XSS-assisted cookie theft, cross-site request forgery (CSRF), and replay attacks. Additionally, you'll compare server-stored sessions with stateless JWTs to ensure the hands-on tasks align with the architectural context.
-
Challenge
Baseline: Insecure Cookie Session
You'll create a basic ASP.NET Core MVC or minimal API project that uses the default in-memory session middleware. By default, the session cookie is sent without Secure or SameSite flags and has a timeout of 20 minutes. You'll verify these settings using curl or your browser’s DevTools.
-
Challenge
Hardening the Session Cookie
You'll enhance the baseline by configuring secure options in AddSession and UseSession. You'll require HTTPS, set the cookie as HttpOnly, configure SameSite=Strict, and reduce the idle timeout to two minutes. You'll then re-run the test and confirm the updated flags in the browser.
-
Challenge
Stateless Authentication with JWT
You'll switch from cookie-based sessions to JWT bearer authentication. You'll set up a login endpoint that generates a signed token using HS256, implement AddAuthentication("Bearer"), and secure the /api/secure route with [Authorize]. You'll demonstrate successful access when the token is valid and provide automatic 401 responses when the token is missing, expired, or altered.
-
Challenge
Knowledge check for Secure Session Management for C# Applications
In this challenge, you will answer some assessment questions that will test your understanding of the concepts you learned throughout this lab.
What's a lab?
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Provided environment for hands-on practice
We will provide the credentials and environment necessary for you to practice right within your browser.
Guided walkthrough
Follow along with the author’s guided walkthrough and build something new in your provided environment!
Did you know?
On average, you retain 75% more of your learning if you get time for practice.