Web application session security with protected session identifiers

A method of secure communication between a web application and a server, comprising:

• receiving, by a session vault routine executing at a client computing device, a first request message directed to a server computing device, wherein the first request message comprises a client session identifier at a session identifier field of the first request message;
• accessing, by the session vault routine, supplemental session identifier data from a session vault persistence at a data storage of the client computing device;
• writing the supplemental session identifier data to a second field of the first request message;
• and
• initiating, by the session vault routine, sending the first request message to the server computing device with the client session identifier at the session identifier field of the first request message and the supplemental session identifier data at the second field of the first request message.

A machine-readable medium comprising instructions stored thereon that, when executed by a computing device, causes the computing device to execute operations comprising:

• receiving, by a session vault routine executing at the computing device, a first request message directed to a server computing device, wherein the first request message comprises a client session identifier at a session identifier field of the first request message;
• accessing, by the session vault routine, supplemental session identifier data from a session vault persistence at a data storage of the computing device;
• writing the supplemental session identifier data to a second field of the first request message;
• and
• initiating, by the session vault routine, sending the first request message to the server computing device with the client session identifier at the session identifier field of the first request message and the supplemental session identifier data at the second field of the first request message.