Which among the below do you think is the right approach for secure session management?
-
Display “Welcome, user!” on the home page
-
Display only “Welcome” on the home page
-
Invalidate and destroy the session when user logs out
-
Use persistent cookies for session management
Secure session management requires completely invalidating and destroying sessions on logout, not just displaying generic messages. This prevents session fixation attacks where an attacker could reuse a valid session identifier after logout. Persistent cookies create additional security risks by extending the attack window.
Proper session management requires that when a user logs out, the session is fully invalidated on the server (and the session cookie discarded), so the same session ID can never be reused by an attacker who captured it. Merely displaying a generic vs. personalized welcome message has nothing to do with session security, and persistent cookies for session tokens are actually a bad practice since they extend the window an attacker could hijack a session.