Catching Compromised Cookies

This post details the technical implementation of detecting compromised cookies by identifying 'session forking'. The core mechanism involves comparing the 'last access timestamp' stored in the cookie with a corresponding timestamp in the database. To mitigate false positives caused by clients not receiving updated cookies, a two-phased approach is introduced: a 'session candidate' cookie is set, and only promoted to the session cookie after confirmation. IP address matching is also used to differentiate legitimate session activity from potential theft. The system now generates risk level assessments based on combined signals and logs high-risk events.