I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used:
- HTTPS Everywhere
- Only use a securely created random string for the cookie value
- Mark the session cookie Secure and HttpOnly
- Change the session cookie on login
I am debating using a suggestion I found in the Tomcat bug tracker. For each session store the following additional information:
- SSL Session ID
- HTTP User Agent
- Remote IP Address
On each request I would validate that two out of the three stored values match what is captured in the session. That way one of the three could change for various reasons without impacting the user. It would be highly unlikely that a normal user would change more than one per request.
Does this seem like a reasonable additional defense for the session cookie?