---
title: Secure Session Wizard
slug: ps/help/en_us/vwaf/ag/secure-session-wizard
docTags: 
createdAt: 2026-08-02T10:05:40.703Z
---

## Purpose

You can start this application-specific wizard on the Wizards tab when you’ve selected an application in the navigation area.

Sessions form a fundamental part of virtually all web applications. Sessions are usually implemented using a session cookie.

vWAF assists in implementing sessions so that a potential attacker can’t operate any session hijacking. To do this, vWAF establishes a separate, secure HTTP session to the user’s browser and generates a separate, cryptographically secure session cookie (you can configure the name of this cookie in [Global Configuration](docId:1MQYcDX4InoZN7IdY-iIB)).

In addition, vWAF also saves all other cookies of the web application and re- inserts them for the next request. The cookies generated by the web application are therefore no longer transmitted to the browser and can no longer be manipulated by an attacker.

:::hint{type="info"}
For more information regarding Wizards, see [Using Wizards to Configure Applications](docId\:fuFTx6amSRULvfNwXXlgj).
:::

## Attributes

| Attribute | Meaning                                                                                       |
| --------- | --------------------------------------------------------------------------------------------- |
| Enable    | Activate the check box in order let the wizard automatically configure the required handlers. |

## Handlers configured by the Secure Session Wizard

The Secure Session Wizard configures the following handlers:

- [Cookie Jar Handler](docId:4Z3FwWQBG15ACv5QdVve_)
- [Session Handler](docId:3LOwZUZAA4bdpX0WBThgO)
- [Valid Request Handler](docId\:okzBT3_J5-JyP_Z7HmaIu)