> For the complete documentation index, see [llms.txt](https://owasp.boireau.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://owasp.boireau.io/4-web_application_security_testing/06-session_management_testing.md).

# Session Management Testing

4.6.1 [Testing for Session Management Schema](/4-web_application_security_testing/06-session_management_testing/01-testing_for_session_management_schema.md)

4.6.2 [Testing for Cookies Attributes](/4-web_application_security_testing/06-session_management_testing/02-testing_for_cookies_attributes.md)

4.6.3 [Testing for Session Fixation](/4-web_application_security_testing/06-session_management_testing/03-testing_for_session_fixation.md)

4.6.4 [Testing for Exposed Session Variables](/4-web_application_security_testing/06-session_management_testing/04-testing_for_exposed_session_variables.md)

4.6.5 [Testing for Cross Site Request Forgery](/4-web_application_security_testing/06-session_management_testing/05-testing_for_cross_site_request_forgery.md)

4.6.6 [Testing for Logout Functionality](/4-web_application_security_testing/06-session_management_testing/06-testing_for_logout_functionality.md)

4.6.7 [Testing Session Timeout](/4-web_application_security_testing/06-session_management_testing/07-testing_session_timeout.md)

4.6.8 [Testing for Session Puzzling](/4-web_application_security_testing/06-session_management_testing/08-testing_for_session_puzzling.md)

4.6.9 [Testing for Session Hijacking](/4-web_application_security_testing/06-session_management_testing/09-testing_for_session_hijacking.md)

4.6.10 [Testing JSON Web Tokens](/4-web_application_security_testing/06-session_management_testing/10-testing_json_web_tokens.md)