Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 11 down vote favorite
8

What are some good practices for ensuring logins, session IDs and session content are secure for a website?

share|improve this question

5 Answers

up vote 15 down vote accepted
  • Use a database for sessions.
  • Regenerate the session on when the permissions change (e.g., when a user logs in).
  • Regenerate the session on every page load (optional).
  • Don't expose the session ID in the URL.
  • Don't expose any sensitive data to the session.
share|improve this answer
1  
Only use the session through secure transport, otherwise someone could sniff the cookie and hijack the session. – Andrew Russell May 13 '11 at 2:00
Alternative to the Regenerate note on page load above, if the previous pages actions(urls) are invalidated then it is a good thing for certain cases. – Andrew Russell May 13 '11 at 2:04
up vote 7 down vote

Expire your session after a reasonable amount of time... Delete the session out of whatever your using as a repository so it can't be re-used...

share|improve this answer
up vote 7 down vote

In addition to VirtuosiMedia's list:

  • Use TLS (SSL) across the entire site. Use the HSTS header.
  • Use a session cookie, rather than adding a session token to every link-href and form-action.
  • Use the secure and httpOnly flags on the cookie.
  • Use the X-Frame-Options header.
  • Keep the content of the session minimal. E.g., store only the user-id. If caching is needed, cache in a general caching layer, not the session.
  • Cryptographically sign the session cookie with a secret key known only to the server. Include an expiration datetime in the signed data. Check the signature and the expiration at the server on every request.
share|improve this answer
"Cryptographically sign the session cookie with a secret key known only to the server." If the cookie contains only the session-id (the key in the database of sessions on the server), how it that helpful? – curiousguy Jul 12 '12 at 23:17
Firstly, is the session-id generated by a cryptgraphically-strong PRNG, and suitably long as to be unguessable and unforgeable? Secondly, it is more important for those who session data in cookies. – yfeldblum Jul 13 '12 at 11:47
up vote 5 down vote

Implement DNSSec to protect your HTTPS session from attacks over Wifi, or public networks including hardwired/switched.

Use HTTPS only for cookies that don't need Javascript access

Use the Secure attribute for all others cookies

Don't allow 3rd party javascript on your site

Similar to the above, don't serve advertisements on your site

share|improve this answer
up vote 4 down vote

don't save password or other user information except user id to the session.

share|improve this answer
So don't use WinForms auth? ;) – StrangeWill Oct 10 '11 at 18:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.