A surf engine that cycles a visitor through sites
Server-held session state, one destination at a time, dwell enforced on the server. The core of a traffic exchange in one table and two functions.
Tagged “sessions”
3 entries
CSRF tokens without a framework
One token per session, compared in constant time, checked on every state-changing POST. Twenty lines and no dependency.
Session cookie settings that survive a security review
Five flags and one call to regenerate. Defaults leave the session cookie readable by scripts and sendable over plain HTTP.