Tagged Questions

2
votes
3answers
155 views

Secure login system - using sessions?

I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this: <?php session_start(); if (validPass() || isset($_SESSION['userId'])) { ...
2
votes
4answers
264 views

When logging out of a website is anything else required then destroying the session?

In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out. session_start(); session_destroy(); Is there anything else that needs to be done? EDIT: I ...
9
votes
4answers
950 views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first ...
3
votes
4answers
172 views

Securing opensource web application

I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
4
votes
2answers
170 views

Any real world examples of GPS location data being used with authentication?

Are there any examples of how GPS coordinate (or any location data really) can be used to detect suspicious locations or validate well known locations? Specifically Highlighting new or unusual ...
3
votes
3answers
623 views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
7
votes
2answers
677 views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
4
votes
1answer
248 views

A Secure Cookie Protocol

As title says I'm trying to implement a secure cookie protocol HMAC(username|expiration name|data|session key, sk) It seams that session key is not constant during whole application session ...
3
votes
3answers
1k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
4
votes
1answer
473 views

Is this admin area secure enough? V2

This is a response to my previous question, Is this admin area secure enough?. There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
3
votes
3answers
318 views

Is this admin area secure enough?

EDIT: Please view the revised question instead The admin area has special access to the database (modifying orders, etc). To help explain, I drew a diagram, so here is my process: Notes: I ...
7
votes
5answers
348 views

Should a user have the ability to be logged in from multiple locations at the same time?

In the past, I've always used a single session per user setup, but I'm working on a project now where a user can be signed in from multiple locations/browsers at the same time. What are the security ...
4
votes
2answers
355 views

Deciding whether user has left the site without logging out or has simply left the site open for notifications without actually doing any work?

I am developing my site using server side sessions using redis as backend for saving the session. Now the issue which is bothering me is of user leaving the website without logging out. I mean user ...
3
votes
4answers
375 views

Is this non-cookie based session scheme horribly vulnerable to some attack?

I am working on a large web application that runs entirely within a single web-page. For various reasons we do not want to use cookies in this web application, at all, but we need to keep track of ...
12
votes
6answers
527 views

Is This Login Security Enough?

I'm coming up with my next login system for admins of an ecommerce website to have login form is SSL secured password is converted to sha256 before being transmitted (bcrypt is too slow still for ...
4
votes
2answers
266 views

Attack vectors in POSTing variables from one php script to the next?

I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as ...
11
votes
5answers
638 views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?