Browser session audit

Require a completed PROCEED scope record. Use only dedicated test accounts and synthetic data.

Workflow

1. Record the unauthenticated baseline before login.
2. In Application, inventory cookie names and attributes without copying values: Secure, HttpOnly, SameSite, domain, path, and expiry.
3. Inventory local/session storage, IndexedDB, Cache Storage, and service workers. Record key names and data classes; redact values.
4. Observe authentication and renewal requests in Network. Never export or replay live credentials outside the authorized browser session.
5. Test logout and session invalidation only for the current test account. Revisit one benign authenticated page and document observed behavior.
6. Compare roles only when multiple dedicated accounts and cross-role checks are explicitly authorized.
7. Search delivered client code and source maps only when allowed; use secret-shaped canaries or redacted prefixes, never publish credentials.

Stop if real-user data, unknown privileged access, third-party sessions, instability, or an out-of-scope origin appears. Never steal tokens, fixate another user’s session, perform credential attacks or brute force, bypass rate limits, persist access, attempt denial of service, make destructive changes, or bulk-extract data.

Missing HttpOnly is relevant only to script-readable cookies; storage presence alone does not prove exploitability. Separate observation, risk condition, and verified impact.

Output contract

For each item return: location, redacted observation, expected control, minimal reproduction, evidence, impact boundary, confidence, and remediation. Include negative results and checks skipped by scope.