Team Harsh

SessionGuard is a continuous-authentication layer for web apps that stops session hijacking, so a stolen session cookie stops working the moment the attacker isn’t the real user. Multi-factor authentication protects the login but not the session that follows. When infostealer malware copies a logged-in user’s session cookie, the attacker can replay it from another machine and the app treats them as the real user, with no password or second factor needed. Most apps have no defense once a session exists, which makes cookie theft a common way around MFA. SessionGuard checks every request in four layers. Deterministic checks (IP, network, user-agent, header fingerprint and impossible travel) catch a lazy replay from a different place or client. A device-bound key closes the gap those checks leave. At login the browser creates a non-extractable cryptographic key, and sensitive actions must be signed by it, so an attacker with a perfect copy of the cookie, user-agent, headers and IP still can’t act without the key. Suspicious sessions are then forced through a Passkey (WebAuthn) step-up or terminated. Finally, an AI explainer writes a plain-English rationale for each decision. It runs after the decision and can never change it. Scores under 30 allow the request, 30 to 70 trigger the Passkey step-up, and over 70 terminate the session. The project is built with an Express app and middleware, a FastAPI risk engine, Redis, SQLite and SimpleWebAuthn. A live demo console shows a victim, an attacker simulator and the decision feed side by side. ~41 automated tests cover replay attacks, forced key rebinding, header spoofing, step-up, prompt injection and dashboard XSS. The explainer works with Muse Spark, local Llama through Ollama, any OpenAI-compatible endpoint, or a deterministic template fallback, so the system keeps working with the AI switched off. There are honest limits. Malware running on the victim’s own device can still use the key, though it can’t copy it. The attacks are simulated against our own demo app, not real-world traffic. The Muse Spark adapter is tested against a stub server and has not been verified against the live API.