--- title: Secure your web app from real-time session attacks description: Onuion is a lightweight, self-hostable session security component that continuously evaluates session risk in real time rather than relying solely on one-time... canonical: https://daily.dev/posts/secure-your-web-app-from-real-time-session-attacks-ypghohupw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Secure your web app from real-time session attacks | daily.dev og:description: Onuion is a lightweight, self-hostable session security component that continuously evaluates session risk in real time rather than relying solely on one-time... og:url: https://daily.dev/posts/secure-your-web-app-from-real-time-session-attacks-ypghohupw og:image: https://api.daily.dev/og/posts/ypgHOHupw.png og:image:alt: Secure your web app from real-time session attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Secure your web app from real-time session attacks **[OpenSouls](https://daily.dev/sources/opensouls)** · [@nihadd](https://daily.dev/nihadd) · 2 min read · 2 upvotes · 0 comments ## Summary Onuion is a lightweight, self-hostable session security component that continuously evaluates session risk in real time rather than relying solely on one-time authentication checks. It analyzes behavioral signals and assigns risk scores to active sessions using a hybrid approach combining rule-based logic with a minimal ML model (~2k parameters) targeting sub-millisecond inference. Designed for self-hosted infrastructure, it integrates with admin panels, API gateways, or internal services to detect account takeover attempts without requiring heavy external security stacks. ## Content Most web applications still approach session security as a simple checklist: enforce strong passwords, add rate limiting, maybe enable 2FA. But in practice, many real-world attacks occur after a user has already authenticated, when the session itself appears legitimate. Because of this, security is gradually shifting away from one-time authentication checks toward continuous session evaluation. Instead of trusting a session indefinitely after login, systems need to keep assessing whether the behavior behind that session still looks normal. This is the idea behind onuion. Onuion is a lightweight, self-hostable component designed to sit alongside your authentication flow and continuously evaluate session risk in real time. It analyzes behavioral signals and assigns a risk score to active sessions, helping detect suspicious activity even when credentials were valid. Rather than relying only on static rules or external security platforms, onuion allows you to bring behavioral risk analysis directly into your own infrastructure. Design principles: - hybrid approach: rule-based logic + lightweight ML detection - extremely small model (~2k parameters) for minimal resource usage - sub-millisecond inference target to avoid slowing down authentication - simple integration with admin panels, API gateways, or internal services If you operate your own infrastructure and want stronger protection against account takeover without heavy security stacks, this approach might be worth exploring. Repo: [https://github.com/onuion/onuion](https://github.com/onuion/onuion) --- [View this post on daily.dev](https://daily.dev/posts/secure-your-web-app-from-real-time-session-attacks-ypghohupw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/secure-your-web-app-from-real-time-session-attacks-ypghohupw","headline":"Secure your web app from real-time session attacks","text":"Onuion is a lightweight, self-hostable session security component that continuously evaluates session risk in real time rather than relying solely on one-time authentication checks. It analyzes behavioral signals and assigns risk scores to active sessions using a hybrid approach combining rule-based logic with a minimal ML model (~2k parameters) targeting sub-millisecond inference. Designed for self-hosted infrastructure, it integrates with admin panels, API gateways, or internal services to detect account takeover attempts without requiring heavy external security stacks.","url":"https://daily.dev/posts/secure-your-web-app-from-real-time-session-attacks-ypghohupw","datePublished":"2026-03-06T04:00:06.044Z","dateModified":"2026-03-06T04:00:39.234Z","author":{"@type":"Person","name":"Nego","url":"https://daily.dev/nihadd","image":"https://avatars.githubusercontent.com/u/61694826?v=4","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":170}},"image":"https://media.daily.dev/image/upload/s--1Dc6PoCW--/f_auto/v1772731474/posts/Z9kt5HHOs?_a=BAMAMiiu0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/opensouls","name":"OpenSouls"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"OpenSouls","item":"https://daily.dev/squads/opensouls"},{"@type":"ListItem","position":3,"name":"Secure your web app from real-time session attacks"}]} ```