A web session is not just a cookie. It is a server-side state machine with rotation, scope, expiry, and revocation rules. These questions focus on the mechanics that decide whether a login remains trustworthy after the password step ends.
0 / 6
Why must a web app issue a fresh session id immediately after successful login?
Press 1 to 4 to pick an answer