Tagged Questions
10
votes
5answers
405 views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
1
vote
0answers
76 views
How can I implement authentication in my proxy server?
I have a proxy server, it will have a captive portal page. Users will be required to sign in before gaining access to the internet.
So far I am aware of IP and/or MAC address based authentication.
...
2
votes
1answer
149 views
How can Bank of America tell that I'm logging in on a computer I haven't used with them before?
When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
1
vote
3answers
121 views
Use Authentication using 2 encrypted strings
So, basically I am trying to log a user in with a cookie and do not query DB to improve performance.
Here is a brief idea:
Transmit everything via SSL
Set a Global secret key A and secret key B
...
1
vote
2answers
112 views
What security issues are there when reading cookie with .htaccess?
I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
9
votes
4answers
940 views
Demystifying Web Authentication (Stateless Session Cookies)
I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages.
Here is my first ...
5
votes
3answers
386 views
Is my session-less authentication system secure?
So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it ...
4
votes
1answer
226 views
Secure web user authentication even after server-side database compromise
By now, we should all know to use bcrypt or scrypt to store salted password hashes with a sufficient number of rounds. (See, e.g., https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet) The ...
4
votes
1answer
247 views
A Secure Cookie Protocol
As title says I'm trying to implement a secure cookie protocol
HMAC(username|expiration name|data|session key, sk)
It seams that session key is not constant during whole application session ...
4
votes
2answers
355 views
Deciding whether user has left the site without logging out or has simply left the site open for notifications without actually doing any work?
I am developing my site using server side sessions using redis as backend for saving the session.
Now the issue which is bothering me is of user leaving the website without logging out.
I mean user ...
3
votes
2answers
174 views
Computer-level logging by financial institutions
I am looking for the best approach to recognizing a specific computer and saving that computer as a "safe" login machine. My intuition points me to using cookies, but what value do I store in there to ...
11
votes
3answers
458 views
Does signing out of a website ensure no-one can cookie hack?
If I click the signout link of a website, does this mean it is not possible for someone to hijack my cookie and sign in with it?
While I'm logged in, is it possible for someone who has access to my ...
8
votes
7answers
292 views
Aren't permanantly logged in accounts inherently insecure?
The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these ...
4
votes
3answers
1k views
What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?
I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional.
My intent is to gracefully ...
11
votes
5answers
638 views
Good session practices
What are some good practices for ensuring logins, session IDs and session content are secure for a website?
