http-session
Session ids required, validated and unguessable
shipped
The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain http-session.
- pack
http- weight
- scored
- scope
- server as deployed (Mcp-Session-Id handling)
- decided by
- http
- since
- 0.2-draft (methodology 0.3-draft)
- config keys
checks.http-session.enabledchecks.http-session.severityserver.headers
Probes
no-sessiontools/list without Mcp-Session-Idforged-sessiontools/list with Mcp-Session-Id: sm-forged-<random>entropythe issued id is at least 16 printable characters and differs between two initializations
Settings and thresholds
Every check also takes checks.http-session.enabled and checks.http-session.severity; they are described once in the configuration reference.
| Threshold | Default | Set with | Standard |
|---|---|---|---|
min_id_chars | 16 | (fixed) | locked |
| Key | Default | Standard | Meaning |
|---|---|---|---|
server.headers | none | not locked | HTTP headers sent to the server (url transport). Values under secret-looking names are redacted. |
How the verdict is established
- Scoring. scored: pass = 1 point, part = 0.5, fail = 0. A fail lowers the pack's percentage but never caps the letter.
What to fix
Issue session ids that are long and random (a CSPRNG, at least 128 bits), require them on later requests, and reject unknown or forged ids with 404 or 400.
False positives
A server that deliberately offers a session-optional mode.
False negatives
Ids that look random but are predictable; session fixation; expiry.