  Session management is a fundamental component of web applications: despite
the apparent simplicity, correctly implementing web sessions is extremely
tricky, as witnessed by the large number of existing attacks. This motivated
the design of formal methods to rigorously reason about web session security
which, however, are not supported at present by suitable automated verification
techniques. In this paper we introduce the first security type system that
enforces session security on a core model of web applications, focusing in
particular on server-side code. We showcase the expressiveness of our type
system by analyzing the session management logic of HotCRP, Moodle, and
phpMyAdmin, unveiling novel security flaws that have been acknowledged by
software developers.
