US Patent 10972481 Web application session security

Various examples are directed to systems and methods for secure communication sessions between a web application and a server. A session identifier routine executing at a computing device may receive a first request message comprising a session identifier field, the session identifier field comprising a client session identifier describing a communication session between the web application executing at the computing device and the server computing device. The session identifier routine may transform the client session identifier to a server session identifier using session identifier transformation data accessed from session vault persistence at the computing device. The session identifier routine may write the server session identifier to the session identifier field of the first request message and initiate sending the request message including the server session identifier to the server computing device.