Session cookie security review cost: $2,400, you own it

Session cookie security review cost is $2,400 once for one app whose signed-in user is a cookie the browser sends back. $1,200 starts the work. The report is due 48 hours after that test login works. You own the PDF. There is no subscription.

Short answer: Session cookie security review cost is $2,400 once, with $1,200 to start, for one app that keeps a signed-in user in a cookie. I check Secure, HttpOnly, and SameSite, whether login issues a new id, and whether logout destroys that id on the server. The report lands 48 hours after access works. You own it. A refresh-token pass and a multi-week accredited pentest are different purchases. The offer is the web application security review.

What does a session cookie security review cost?#

$2,400 once for one app, $1,200 to start, the rest when the PDF lands. You own that file. You are not buying a cookie-consent banner, a scanner seat, or a certificate I do not hold. Two reviews a year apart are $4,800 over 24 months.

The comparison uses published ranges, not guesses. WardenBit’s 2026 guide puts $100–$3,000 on mostly automated scanning. Pentestica’s price guide, last updated 4 November 2026, lists a manual web application or API test at $2,500–$5,500, with exploitation evidence in the report. Mine does not. Three passes, a year apart, are $7,200 over 36 months.

What you are buying	2026 price	What you actually get
Cookie-consent or scanner seat	Often monthly	A banner or a tool dump. Not a test of your login cookie
Mostly automated scan	$100–$3,000	Tool output. Thin judgment on fixation or logout
This review	$2,400 once, $1,200 to start	One app, the session cookie, report in 48 hours, one retest
Manual web app or API test	$2,500–$5,500	Longer calendar, wider app, exploitation evidence in the report

The same $2,400 is on pricing. If the product is a SaaS app with customer accounts, the industry page is website security review for SaaS. A token that mints new access without a cookie is a different writeup: refresh token security review cost.

What does the $2,400 check on the session cookie?#

I sign in once with the test user you send and record the cookie the browser keeps. The pass covers the flags, whether the pre-login id still works, and whether logout stops the next request. I do not ship a recipe for stealing a cookie.

OWASP’s session management cheat sheet treats Secure, HttpOnly, and an explicit SameSite of Strict or Lax as mandatory. SameSite is defense in depth, not a CSRF token. Never send SameSite=None without Secure, and do not trust the browser default. A __Host- prefix forces Secure, no Domain, and Path=/.

The same sheet wants at least 64 bits of entropy (16 hex characters). A fixed prefix cuts that in half. If you mint the id yourself, use a CSPRNG of at least 128 bits. Cited idle timeouts are 2–5 minutes for high-value apps and 15–30 minutes for low-risk ones, with an absolute timeout of 4–8 hours for a full office day. I compare those to what your server enforces.

OWASP’s session fixation test says the failure is keeping the same cookie value before and after authentication. Invalidate the old id and issue another after a successful login. Browser close is not a logout. The cheat sheet says close events are unreliable, so the server has to expire the id.

I record, in plain findings:

• Whether the cookie carries Secure, HttpOnly, and an explicit SameSite, and whether a __Host- or __Secure- prefix matches how it is set.
• Whether the id issued before login is still accepted after login.
• The idle and absolute lifetimes the server enforces, against the numbers you wrote down.
• Whether logout, a password change, or a disabled account stops the next request that still sends the old cookie.

The document shape is the sample pentest report. No client names. No exploit steps. No cookie values.

What is not included for $2,400?#

You get severity, the cookie name and path, the role, and a fix an engineer can ticket, for one authorized app. I do not ship exploit steps, a vendor-tenant audit, a second app, or a certificate I do not hold. The PDF is yours. There is no monthly fee.

I do not need your production cookie store. If the id also appears in a page or a URL, I name that path and I do not print the value. A refresh token, a magic-link email, and a second app are each a different quote.

This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not test a login cookie.

How does the review run from the cookie to the PDF?#

You authorize one app, I sign in with the test user you send, and the clock starts when that login works. The PDF is what you keep. I do not change production cookies inside this price.

Step	What happens
Trigger	A buyer asked whether a stolen cookie still opens the account, or login still reuses the anonymous id
Action	I sign in once and record the cookie flags, the id change, and what logout still accepts
System of record	The running app, plus the written findings: severity, path, role, fix
Human escalation	You ticket the change. I do not edit production inside this price

Send written authorization and one test user. One free retest of that same app is included within 14 days.

When this isn’t the right move yet#

Do not pay the $1,200 if the signed-in user is not a cookie yet, or if I cannot legally use the login. A pass with no session cookie is a normal login skim. Ship the cookie, then book the review.

Wait if nothing live will accept a login. Hire the firm that holds CREST if the questionnaire requires that name. If the only question is a refresh token that keeps minting access, buy that writeup instead of this one twice. A missed phone is the receptionist, $8,000 once, not this review.

What should be true before I start?#

Bring one login, one test user, and the idle and absolute lifetimes you think the server enforces. I start when that cookie behaves like production, not when the consent banner looks finished.

Before you pay, write the list:

• The cookie name, and whether it is meant to be __Host- scoped to this host only.
• The idle lifetime and the absolute lifetime you intend, in minutes or hours.
• Whether the id from before login must fail after a successful sign-in.
• Whether logout, a password change, or a disabled account must reject the old cookie.

If you want the layout before credentials, ask for the sample from the contact form.

$1,200 reserves the work on the review page. I confirm scope in writing before I start. The form is short. I reply with the replacement map within 24 hours. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.