Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

learn more… | top users | synonyms

1
vote
2answers
58 views

Is it required to end the session after closing the browser without logging out?

Should the Session ID generated after logging in be marked invalid when the user closes the browser without logging out? Could this be a security flaw? If yes,is it possible to exploit this?
0
votes
0answers
13 views

How can I unset the session of a specific user? [migrated]

I have a session like this $_SESSION['login'] and when it is equal with 1, it means the use is logged into my website: if ( $_SESSION['login'] == 1 ) { // You are logged } else { // login/...
0
votes
0answers
16 views

Is it possible to hijack any cookie based session by sending the PHPSESSID cookie of a user in a request?

Assuming that someone - gets the PHPSESSID (session cookie of a PHP based application) of a user for a web application. and tries to hijack within the expiry time of a cookie (Goes to any ...
0
votes
2answers
102 views

Anti session-hijacking mechanism using a session variable

Okay, So I'm brainstorming about a security architecture where on a website you have a 'secret' page, where a visitor (not user, just visitor) can enter 'secret' info. The visitor doesn't need to ...
1
vote
1answer
33 views

Why would you maintain multiple session ID's in one application?

There is a web application and I am looking at the cookies values after authentication using Burp proxy. There are 5 different cookies, say c1, c2, c3, c4, c5. When I tampered with the values of ...
0
votes
1answer
43 views

Security issues with concurrent sessions in iOS app and Safari browser

We have two ways a user can buy products on our e-store. We have a mobile native app for iPhones and a mobile optimized browser experience from an iPhone default browser (i.e. Safari). The iOS (...
-1
votes
3answers
45 views

How do cookie and session implement for preventing reuse elsewhere

I have some scenarios: A cookie is generated on Chrome and will be used in Firefox in the same machine. A cookie is generated on Chrome and will be used in Chrome on a different machine. A cookie is ...
3
votes
1answer
80 views

Why are user names generally not stored in session cookies and provided with session IDs?

I have been reading a little bit about security lately and wondered this. Why are session IDs not essentially temporary passwords linked to the user name? Both being sent from the client and checked ...
1
vote
2answers
81 views

Remember me vs. persistent session for web applications

This question is intended to gather information about what the specific security advantages/disadvantages are to using a "remember me" function for an online web site relying on sessions compared with ...
0
votes
2answers
151 views

Why not have an identical session cookie for different user's devices?

Here is my table structure: // users +----+--------+------------------------+------------------+-------------------------------+ | id | name | email | cookie | /* some ...
0
votes
1answer
69 views

Is Tomcat session ID generation FIPS compliant?

I am trying to achieve the following security rule server must generate a unique session identifier using a FIPS 140-2 approved random number generator. I am using Tomcat 7.0.68 for my server, I am ...
3
votes
1answer
46 views

Should a corporate laptop client-server VPN connection last for days?

I was experimenting over the past few days with letting my laptop hibernate vs. shutting down on a daily basis (I have always been a shutdown guy, but am trying to update myself). While on business ...
1
vote
1answer
90 views

How to protect the Session ID?

I have been doing some reading over the past few days on Session IDs and the methods taken to prevent people from intercepting them and using them to hijack a session. From what I have read, when ...
4
votes
1answer
154 views

PHP Session Vulnerability

I'm trying to solve a challenge on a CTF, with PHP sessions. The goal is to make check.php echo $_PASSWORD. I do not have access to the files themselves, and therefore I cannot edit them. My ...
1
vote
1answer
37 views

Risk in not expiring an “unsubscribe” link

Are there any risks with an "unsubscribe" link in e-mails that never expires? The e-mails are sent to customers. The token used to unsubscribe the customer will include a customer ID encoded using ...
0
votes
1answer
57 views

SSL session protocol vs SSL connection protocol

Slide 8, SSL Session Protocol: Slide 10, SSL connection protocol: Firstly, in Session Protocol, there is a {S}_B, what is the function of this {S}_B? Does't it help in proving Alice's identity? ...
3
votes
1answer
80 views

Fear regarding session tokens

I have read recently that sessions work as follows: Your credentials are checked. A token is generated and stored on server side, eg UUID, and this token is given to the client where it is stored ...
0
votes
1answer
45 views

Site stores cookie name and user id in script tag after login. Is this an issue for either xss or session highjack?

Upfront I will say that this is not my website and that I am simply doing a general audit (for non security issues), but ran across this in the source after logging in. Another script tag for ...
2
votes
1answer
81 views

Cross-domain session standardization

I am looking into cross-domain sessions. These are sessions which are shared between two domains like google.com and spotify.com. I'm not looking for information regarding cross-domain sessions ...
4
votes
2answers
89 views

Is allowing users to sign out of all other sessions good or bad?

I'm not really sure if this feature is a good security idea, but would it be good to allow a user to sign out of all other sessions? Or would this be a bad idea, because I see a good amount of pros, ...
1
vote
3answers
197 views

Asp.net web forms is not generating a new session id if a user logs out and logs back in

Asp.net web forms is not generating a new session id if a user logs out and logs back in. Is this a major security risk? We're using SSL.
0
votes
1answer
183 views

How is UDP hijacking even possible?

My doubt is this: UDP has no sequence numbers, so what indeed is the concept behind UDP session hijacking?
1
vote
2answers
50 views

Is this a session fixation

I really can't understand the session fixation attack. I've read OWASP definition that said: Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack ...
2
votes
2answers
157 views

Is it bad if session key is passed in plain text in URL?

In a class we were told that it's dangerous to put the session key in the URL because it could be cached, either by the browser or a proxy etc. Is this correct? Even if it was cached shouldn't the ...
4
votes
2answers
232 views

In which OSI layer does session hijacking occur?

In which layer of the OSI model does session hijacking occur? I have performed some research on this, and found that the answer is the transport layer. But is the transport layer not the place ...
3
votes
1answer
80 views

How to prevent data from Interception?

I am a web developer. A few days ago, I used Burp, to intercept facebook's official App over network, by setting up proxy. I noticed that the data was encrypted. While I have been using Json to ...
1
vote
1answer
47 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
3
votes
1answer
132 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
1
vote
2answers
196 views

Prevent Session Hijacking, where an attacker steals Session ID(cookie) from the browser physically

Consider a case, where an attacker has physical access of user's machine for 20-30 seconds. The attacker can use this time to steal user's cookie (say using EditThisCookie plugin) and send the cookies ...
1
vote
2answers
181 views

When should server side sessions be used instead of client side sessions?

From an information security perspective, when should server side sessions be enabled instead of client side sessions? From what I gather, "secure client side sessions" are cookies that contain data ...
0
votes
1answer
129 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ("Cache-Control:no-cache"...
1
vote
1answer
99 views

Handling session tokens when a users IP changes with extreme frequency

My web service is an API-driven Single-Page-Application. Once the user logs in they're given a temporary token to use for the rest of the session which is sent along with each API request. The token ...
1
vote
4answers
176 views

Why is MITM required for Session Hijacking?

As I understand, the basic concept of Session Hijacking is intercepting a packet in which the victim sends its cookie/session credentials to a server, be it Facebook/Twitter/YouTube/Whatever. But ...
0
votes
1answer
85 views

OpenSSL gmail - receiving Please log in via your web browser and then try again

Using openssl as below when I do EHLO auth login and then enter my username and password I get the following error: Please log in via your web browser and then try again. Learn ...
2
votes
1answer
363 views

Single Page Application session management

I have a Single Page Application which is fully HTML+JS+CSS (using frameworks such as jQuery and AngularJS) and a server side API using ASP.NET WebApi. The SPA is served in a server similar to a CDN ...
3
votes
0answers
65 views

How to group user actions within the same session?

I'm working on enterprise application where it's needed to audit all user actions (data modification, settings changing etc.) within their work session. What is the best way to group all that actions ...
0
votes
0answers
22 views

Cookies carrying Session identifiers

Is there a list of names for cookies carrying SID's? For instance: PHP by default uses PHPSESSIONID Tomcat uses JSESSIONID ... I would like to be able to intercepts all SID's supplied via ...
8
votes
3answers
747 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
5
votes
2answers
1k views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
2
votes
2answers
390 views

Why does OWASP recommend “Disable Web Browser Cross-Tab Sessions”

I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same ...
8
votes
4answers
1k views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
0
votes
4answers
157 views

Is session expiration for all web applications possible?

In case someone visits an infected site his safety, if his cookies get stolen, may be compromised. Is there any abstract way to expire a session on the stolen session-id so that the id is practically ...
1
vote
0answers
53 views

PHP session and page data inconsistencies [closed]

I have a problem and I'm not immediately sure how to go about resolving it. I have been building a secured login system on a HTTPS server (with a grade of "A" by SSL-labs, if that's worth anything ),...
0
votes
2answers
60 views

Is it insecure to temporarily save user's data in a session while they register?

My plan is to save the registration, as they go along so if they close the page by accident they will still have all of there information saved so they can continue it again. But my question is it ...
1
vote
1answer
325 views

Session Expiry due to weblogic.xml for mitigation of cookie hijacking? [closed]

To ensure strict security at web application, we tried to mitigate cookie hijacking by adding code to weblogic.xml. Following is what we did: Example that we had applied on weblogic.xml and faced ...
3
votes
1answer
204 views

SSL session ID in TLS ticket based resumption

We have a server which supports TLS ticket based stateless session resumption. However, when I connect to the server using openssl s_client, I still see a session ID being generated along with the TLS ...
4
votes
2answers
142 views

How much data should I store on a user's computer about their login info?

I'm currently saving a user's "login" information (not their raw password, of course!). Every device/browser gets its own secure ID from the server, all well and good. However, should I verify more ...
2
votes
1answer
188 views

Use salt as identifier for crypted session id in database based authentication system for webapp

I have written a database-based authentication framework for webapps I am planning to program in the future. The framework is implemented by using the plpgsql-language of a PostgreSQL-Database and ...
2
votes
1answer
108 views

TLS Session Tickets: What is the risk of a disclosed server ticket key?

So there is this TLS Session resumption method using Session Tickets which transfers the TLS server secret state to the client (encrypted and authenticated with a key only known to the server) If a ...
6
votes
2answers
144 views

Tie the session ID to the SSL session

The OWASP website says: Tie the session ID to the SSL session and provide configurable options for actions to take if the session ID is transmitted over a new SSL session. I am not sure if ...