Session security and account recovery
Once a player logs in, the session is the key to their account. A stolen or fixed session bypasses passwords and MFA entirely, and weak account recovery hands attackers a side door. OWASP's session management guidance sets clear technical baselines for both.
Session identifiers
The OWASP Session Management Cheat Sheet says: "Session identifiers must have at least 64 bits of entropy to prevent brute-force session guessing attacks." It also says: "The session ID must be renewed or regenerated by the web application after any privilege level change", which includes logging in. Regenerating at login stops session fixation, where an attacker plants a known ID before the player authenticates.
Cookie settings
| Attribute | Why |
|---|---|
| HttpOnly | Stops scripts reading the session cookie. OWASP calls this protection "mandatory to prevent session ID stealing through XSS attacks". |
| Secure | Cookie sent only over HTTPS. |
| SameSite | OWASP: "Session cookies must explicitly set SameSite=Strict (preferred) or SameSite=Lax." |
| Narrow path and domain | Limit where the cookie is sent; avoid sharing session cookies across subdomains that do not need them. |
Timeouts
OWASP notes that "Common idle timeouts ranges are 2-5 minutes for high-value applications and 15-30 minutes for low risk applications", with an absolute timeout example of four to eight hours. Gambling accounts hold money but players expect uninterrupted play, so many operators combine a moderate idle timeout with re-authentication for sensitive actions such as withdrawals or changing payment details. Whatever you choose, document the reasoning.
Logout and revocation
OWASP says that on logout "the web application must invalidate the session at least on server side". Give players a "log out of all devices" option, and revoke all sessions automatically on password reset, MFA change or confirmed takeover. For apps using tokens, keep access tokens short-lived and make refresh tokens revocable.
Account recovery
Recovery flows are a frequent takeover route because they replace the password. Good practice:
- send recovery links only to contact details already on file, and expire them quickly;
- do not let a recovery flow change the email, phone and withdrawal destination in one step;
- notify the player through every existing channel when recovery or a change happens;
- revoke all existing sessions when recovery completes;
- train support staff not to bypass verification under pressure, and log every manual recovery.
Monitoring
Log session creation, privilege changes, concurrent sessions and unusual session reuse from different networks, with access controls on the logs themselves. OWASP Top 10:2025 lists "Security Logging & Alerting Failures" as A09, a reminder that controls without monitoring leave attacks unseen.
Questions about session security
Why regenerate the session ID at login?
To prevent session fixation. OWASP says the session ID must be renewed or regenerated after any privilege level change, and logging in is one.
How long should a gambling session last?
There is no single rule. OWASP cites idle timeouts of 2 to 5 minutes for high-value applications and 15 to 30 minutes for low-risk ones. Many operators pair a moderate idle timeout with re-authentication for withdrawals and account changes.
Sources
- OWASP, Session Management Cheat Sheet
- OWASP, Top 10:2025 (A07, A09)
- All sources checked 24 October 2026.