Tokens and sessions

Play this lesson

Signed in, and then?

Remy wires up what happens after sign-in. Each request carries a token: a string that proves who sent it. OWASP calls it a session ID, "assigned at session creation time", and says its value "must never include sensitive information".

Short tokens, long refresh

Firebase: "ID tokens are short lived and last for an hour; the refresh token can be used to retrieve new ID tokens."

A refresh token lasts until the player is deleted or disabled, or "a major account change is detected", such as a new password. The studio can also revoke a player's refresh tokens itself.

Quick check

A player's ID token is stolen. For how long can the thief use it, at most?

  1. About an hour, until it expires
  2. Forever
  3. Until the player buys something
Show the answer

About an hour, until it expires

ID tokens last an hour. That is why they are short: a stolen one stops working soon.

Cookies done safely

On the web, a session often lives in a cookie. OWASP's rules:

Read the cookie

response
Set-Cookie:  session=8f3a91c2;  Secure; SameSite=Lax

Remy's server sends this cookie. Which protection is missing?

  1. HttpOnly: a script on the page could read it
  2. Secure
  3. SameSite
Show the answer

HttpOnly: a script on the page could read it

OWASP calls HttpOnly "mandatory to prevent session ID stealing through XSS attacks", where an attacker's script runs on the page.

Timeouts and fresh IDs

An idle timeout ends a session nobody is using. An absolute timeout ends any session after a set time. OWASP suggests idle timeouts of "2-5 minutes for high-value applications and 15-30 minutes for low risk".

A new session ID after sign-in is "mandatory to prevent session fixation attacks".

True story: one click, no password

On 16 January 2019, Check Point Research showed how it could take over any Fortnite account. Epic Games had old sites still online, such as ut2004stats.epicgames.com, and that one let an attacker's script run. Epic's sign-in page would send a player on to any page on Epic's domain, that one included.

A player only had to click a link, with "no need even for them to enter any login credentials", and the script caught the sign-in token. Check Point told Epic, and a fix was deployed.

Source: Check Point Research: Hacking Fortnite (16 Jan 2019), research.checkpoint.com

Quick check

What should Shard Garden learn from it?

  1. Shut down old sites, and after sign-in only send players to an exact list of pages
  2. Make tokens longer
  3. Ask players never to click links
Show the answer

Shut down old sites, and after sign-in only send players to an exact list of pages

The old site gave the script a home, and the open redirect delivered the token to it. Removing either breaks the attack.

The studio's own keys

Players' tokens are one kind of secret. The studio's own keys, for databases and payments, are another.

Bolt says: Next: secrets management.

Fact-checked 12 October 2026