Session handling rule editor - Port Swigger
Summary: PortSwigger's documentation describes the session handling rule editor in Burp Suite, opened via Settings > Sessions > Session handling rules, which lets users add or edit rules across two tabs. Each rule contains one or more actions that Burp performs in sequence, including running macros, updating cookies from Burp's cookie jar, checking session validity, and invoking extensions that have registered a session handling action handler.
Bottom line: The editor's session validity check can be configured to run only after a set number of requests, so a rule built to avoid unnecessary traffic may let an invalidated session persist through part of an automated scan or Intruder attack before Burp detects it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026