Secured Application Step 3: Decide and Document

Write down which mechanism your application uses and why, in a paragraph. If it is sessions, confirm all three cookie flags are set in production settings and check them in the browser's developer tools rather than assuming. If it is tokens, write down where the token lives, what happens on sign out, and how you would revoke access for a compromised account today. If you cannot answer that last question, that is the finding, and switching to sessions is a legitimate response to it.