Web Application Defender's Cookbook

Chapter 8

Defending Session State

Now the general who wins a battle makes many calculations in his temple ere the battle is fought. The general who loses a battle makes but few calculations beforehand. Thus do many calculations lead to victory and few calculations to defeat: how much more no calculation at all! It is by attention to this point that I can foresee who is likely to win or lose.

—Sun Tzu in The Art of War

ModSecurity has a robust session-based persistent storage mechanism that allows defenders to track and analyze a variety of data about application users.