Session Cookies Done Right

There is no shortage of articles about Wireshark. Most of them cover the happy path. This one is about what happened after the happy path ended.

The setup was ordinary: Wireshark at the edges, Burp Suite doing most of the heavy lifting, and a handful of scripts nobody wanted to own. It worked well until usage roughly doubled over a single quarter.

Where we started

The first symptom was subtle. Nothing failed outright, but session management kept drifting in the wrong direction, and every fix seemed to make the next one harder.

Most of the complexity was accidental. Over the years we'd layered three different approaches to session management on top of each other, and each one made sense at the time.

The fix

Rather than a big-bang rewrite, we migrated one module at a time over about 8 weeks, keeping both paths alive behind a flag.

Here's a trimmed-down version of what we ended up with:

cosign sign --yes ghcr.io/acme/api@sha256:3f1c...
cosign verify \
  --certificate-identity-regexp 'https://github.com/acme/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/acme/api@sha256:3f1c...

Nothing about this is clever, and that's the point. Anyone on the team can read it in a minute and know exactly what it does.

A few things that helped along the way:

• Measure before and after, even if it's just a rough number in a spreadsheet.
• Agree on what "done" means before the first pull request.
• Delete dead code aggressively; it's the cheapest refactor there is.
• Write the migration guide before writing the migration.

What it cost us

There are cases where this falls apart. If your team is very small or your traffic is very spiky, the extra moving parts may not pay for themselves.

The biggest cost was social, not technical. Changing how people think about session management takes much longer than changing the code.

Takeaways

I don't think there's a universal answer here, but I hope this gives you a few ideas to try on your own project. If you do, I'd love to hear how it goes.