The tag has no wiki summary.

learn more… | top users | synonyms

5
votes
1answer
34 views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § ...
2
votes
2answers
85 views

Can sessions be handled securely with cookies disabled?

I've been doing some reading here about session ID handling, and have learned that it's generally a bad idea to include a session ID in the HTML source code, and/or on the query string. For example Is ...
0
votes
1answer
679 views

Javascript http to https redirect - how vulnerable/how secure? [duplicate]

If I had a website http://site.com redirecting to https://site.com via javascript (with a HTTP/1.1 403 Forbidden), what are the attack vectors I could be vulnerable too? Why is this not a good ...
1
vote
1answer
194 views

Preventive Measure for detecting Session Fixation attacks

From my understanding if i am not wrong in session fixation attacks. The attacker login into the server as a legitimate user and creates a valid session. He then the tricks the compromised user to use ...
6
votes
2answers
522 views

Session Cookie Stealing Protection

I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used: HTTPS Everywhere Only use a securely created random ...
9
votes
2answers
1k views

Protecting against cross-subdomain cookie attacks

I have been reading about cross-subdomain cookie attacks here. A quick overview of how it works (from Wikipedia): A web site www.example.com hands out subdomains to untrusted third parties One such ...
5
votes
2answers
2k views

Best way to securely set a session cookie on another domain

We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com. The www site does not have an SSL certificate and is on a different domain. We have a login button on http://www.foo.co.uk ...
4
votes
3answers
3k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
1
vote
2answers
309 views

Session management: Are the features of application server enough?

HTTP is a stateless protocol. However, when the user logs into a web application, he likes that some session information be preserved, such that he does not have to login again when he wants to go ...
3
votes
1answer
370 views

OpenID Session Fixation with CSRF

This answer describes a situation where CSRF can be used to trick an end user to enter a credit card into another person's Paypal account. It also highlights the fact that state-changing GET requests ...
2
votes
3answers
543 views

Session fixation attack

Given the following conditions, Session ID does not change upon login Session ID travels in form of HTTP cookie There is no cross site scripting/redirection vulnerability on the login page is it ...
3
votes
1answer
2k views

Will session_regenerate_id() without true parameter improves security? Should I use it right before login?

I want to decrease session fixation attack vulnerability, hence I used session_regenerate_id() before login. Somehow I'm in dark now and not sure the right answer for questions below: When we ...