Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-sess-01
Testing for Session Management Schema
Passed 21 of 22 test cases with the skill, and 18 of 22 without it.
and 2 more in the full report
3 fixed18 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
What CVSS score and severity rating apply when an application fails to set the HttpOnly flag on session cookies?
| Checked | Without skill | With skill |
|---|---|---|
| Assigns a CVSS score of 6.1 to missing HttpOnly cookie flags | Missed | Passed |
| Classifies missing HttpOnly cookie flags as Medium severity | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-SESS-01
Testing for Session Management Schema
Session management is the mechanism by which a web application maintains state with users across multiple requests. Weaknesses in session management can lead to session hijacking, fixation, or prediction attacks. This test evaluates the overall session management implementation including token generation, transmission, storage, and lifecycle management.
| Phase | Security Concern |
|---|---|
| Generation | Randomness, entropy |
| Transmission | HTTPS, secure headers |
| Storage | HttpOnly, Secure flags |
| Validation | Server-side checks |
| Termination | Proper invalidation |
test cases passed, vs 18 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.