Use for any question or task about testing sessions, login or logout security in a web app, in any framework, including one login handler and old cookies that still work after logout: cookie flags (Secure, HttpOnly, SameSite), session ID regeneration on login, idle and absolute timeouts, concurrent-session limits, logout on all devices, CSRF tokens and session binding, per OWASP ASVS V3.