Case: Cookie Flags + Session Limits Killed a Hijack Campaign

Case: Cookie Flags + Session Limits Killed a Hijack Campaign
A site suffered repeat admin hijacks where a stolen auth cookie kept working for weeks across IPs.

Session SOP:

— Step 1: Force Secure, HttpOnly, and SameSite=Lax on all auth cookies at the edge.
— Step 2: Shorten auth cookie lifetime from the 14-day default to 12 hours for admins.
— Step 3: Bind sessions to a coarse network check; force re-auth on a major IP-block change for admin role.
— Step 4: Add a one-click "log out everywhere" and rotate salts when triggered.
— Step 5: Rotate salts now to invalidate every existing session.

Outcome: Salt rotation evicted 47 live sessions including the attacker's. The 12-hour expiry meant a future stolen cookie was dead by next morning. Repeat hijacks: 0 over 5 months.

Run this every time.