Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

learn more… | top users | synonyms

1
vote
2answers
41 views

I want to figure out how cookies/ session variables interact to validate a user session

---I have been experimenting on cookies/ session ids and have a little trouble digesting in the concepts. I'm working on a Debian distro. Using Burp to capture/alter requests/ responses. What I know ...
0
votes
0answers
53 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
3
votes
1answer
46 views

At what level does session key entropy become a real-world issue?

Say we have a session key of between 0000000000-9999999999, providing 33.2bits of entropy. This is far short of the 128bits recommended by most. Of course, it is normally trivial to change session ...
2
votes
2answers
103 views

Exploiting a potential ASP.NET web app Session Fixation vulnerability

I am pen-testing an ASP.NET application that is exhibiting Session Fixation behavior. The application is using cookie based sessions. Basically: When you land on the page no Session cookie is ...
3
votes
2answers
58 views

Should a session ID ever be sent over an unencrypted connection?

I'm teaching myself a touch of the most basic information security while toying with web dev, so that I can get a better understanding of the whole picture. Let's assume my website has user accounts ...
3
votes
1answer
173 views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
2
votes
0answers
26 views

SAML Without Session

Is there a way to implement SAML-based authentication to an IdP where the client keeps the session information? The idea is that a load-balanced server farm for the SP would be able to remain ...
0
votes
0answers
152 views

session management and login php scripts

I want to to write login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. There are password protected control panels in abundance, ...
0
votes
0answers
28 views

Securing php session using extra settings [duplicate]

I have googling on securing php session and came across this link http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL where they suggest to start like this as below. $session_name ...
7
votes
3answers
203 views

What is the state of the art for forcing logout on browser quit?

Background: Most browsers have implemented some form of "Session Restore" functionality as a convenience to users where, if enabled, session cookies will be persisted across browser restarts. ...
3
votes
3answers
374 views

Passing session id in query string to maintain state in third party iframe - good practice?

I would like to allow the user to be "logged in" and maintain state / logged in status between pages within an iframe. The iframe content is ours, and will be hosted on various clients' websites. ...
3
votes
1answer
238 views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
3
votes
1answer
131 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
3
votes
2answers
103 views

How does a browser manage secure sessions and store session keys?

I am interested in how a browser manages secure sessions. As I understand it this is the scenario when logging into a google account: 1) Browser (B) and google Server (S) perform a handshake to ...
2
votes
1answer
121 views

Is this somebody trying to exploit a vulnerability?

On our website, when an invalid PHP session ID is detected, it's logged and regenerated. This invalid session has been logged: n040jl1nujch72tkrmr0uilnl1, ...
2
votes
1answer
183 views

How secure are PHP sessions?

Should i worry about securing PHP sessions for my users? How do hackers steal the sessions? The information users of my site can view is not at all sensitive and if viewed or modified by a hacker ...
4
votes
1answer
145 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
0
votes
2answers
197 views

How session cookies work? [closed]

I want to know the basic working of session cookies. When i tried googling, most of the results came were based on any programming language. I am not good at coding. So it will be helpful if someone ...
3
votes
2answers
129 views

Could HTTPS-Attacks like CRIME be mitigated by changing the session cookie regularly?

I was just reading about CRIME which is an attack to steal sensitive information by creating requests. Could this attack be mitigated, if the Server wouldn't send the client the actual session key to ...
0
votes
1answer
113 views

Using encrypted data in session key instead of random

I am writing a service-oriented (REST) application that is (nearly) totally stateless: it can authenticate by API keys, but for web UI it uses the session where it stores nothing but an authenticated ...
7
votes
2answers
925 views

Are my session settings secure enough?

I'm developing a file hosting and sharing web application. Are the following PHP session settings secure enough? ini_set('session.cookie_httponly', 1); ini_set('session.cookie_lifetime', 0); ...
1
vote
0answers
89 views

Passing Encryption Key Across Session for Symmetrically-Encrypted DB

I'm building a database that symmetrically encrypts user data. Nothing super sensitive, I'd use a third-party if it was. The data is encrypted with a surrogate key; the user must enter a password to ...
0
votes
1answer
85 views

Setting a temporary cookie to an invalid value when logout improves security?

When a session is closed, for example, when a timeout triggers or when the user clicks the logout button, the session should be terminated at server side so the session cookie is invalid. I think ...
0
votes
3answers
225 views

Does it have sense a One-Time Session Cookie?

Recently I have faced a site that seems to implement something that we can call "one-time cookie". This cookie is used for single-sign on among different sites. In each request the server sends a ...
3
votes
2answers
151 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
8
votes
1answer
523 views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § ...
2
votes
1answer
628 views

HeartBleed - how do I invalidate all session cookies?

As part of the Heartbleed event, I have upgraded OpenSSL, reissued and replaced certificates and revoked the old ones and changed passwords however, I am also seeing advice to invalidate all session ...
1
vote
0answers
1k views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
0
votes
1answer
301 views

Which approach to encrypting data on a per-user basis is more secure?

As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a ...
1
vote
1answer
344 views

Increasing tomcat session id increases security

Tomcat gives a configuration sessionIdLength to be configurable, but does increasing the session id increases its security or its just security through obscurity
1
vote
2answers
328 views

Is it safe to use Diffie-Hellman public keys as nonces to protect against replay attacks?

I have an interesting case regarding protection against replay attacks. Under the assumption that Alice and Bob have used Diffie-Hellman key exchange to establish a secure temporary session, would it ...
0
votes
1answer
145 views

Wouldn't transient cookies for session management increase effectiveness of MITM?

According to wikipedia, a transient cookie (aka session-cookie, in-memory cookie) is forgotten when the user closes the browser. These are also recommended for session cookies by OWASP. I've seen a ...
-6
votes
4answers
318 views

user authentication my method (reinventing the wheel) is this secure?

I have read many articles advising to use OpenID, including Stack Overflow Q&A, for authentication. Unfortunately I can't use openid because my auth is not based on an email id - it is based on ...
2
votes
2answers
180 views

safe methods of generating session keys

So I have this web app where I'm supposed to generate my own session key to use in the session manager. I just have few questions about safe approaches to this. I believe to make this safe it should ...
1
vote
1answer
97 views

How much harm can an attacker do on the Diffie-Hellman exchange?

I'm looking at a system that uses an unprotected Diffie-Hellman exchange to negotiate a key for the session encryption. That Diffie-Hellman is not secure against man-in-the-middle attacks is textbook ...
2
votes
0answers
243 views

What causes wifi network connections to timeout? [closed]

i was wondering what actually causes wifi network connections to timeout. for instance, say my laptop is connected to my wifi and i yank the battery out such that my laptop can't send any proper ...
1
vote
0answers
611 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
0
votes
2answers
23k views

SSL Handshake failed

I’m working on windows desktop application which is created using C++ (IDE : Qt creator). It has login panel, where i do user validation via https connection using openssl 1.0 library. Application is ...
2
votes
2answers
255 views

Can sessions be handled securely with cookies disabled?

I've been doing some reading here about session ID handling, and have learned that it's generally a bad idea to include a session ID in the HTML source code, and/or on the query string. For example Is ...
9
votes
4answers
4k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
4
votes
2answers
841 views

Windows Authentication and Session Ids

After a penetration test made upon an intranet application I'm developing, in ASP.NET MVC, one of the concerns raised was that the application supports concurrent user sessions and it is recommended ...
4
votes
2answers
258 views

What type of information should be shown to an end user for a logon session summary?

Google, Yahoo, Facebook and several banks have a session summary screen that lists a variety of information, but they aren't consistent in what is offered to the end user. e.g. Facebook offers a ...
1
vote
1answer
824 views

Using Random Numbers As Session variables

I am using randomly generated numbers as session variables to identify the sessions in a PHP application. To make further security proof what ways should I follow?
1
vote
2answers
735 views

How long should a browser session last?

I have two online accounts from different banks, one bank expires my session faster than the other, it's quite annoying. I was wondering how long (or short) should a session be for it to be ...
0
votes
1answer
410 views

What mechanism to use for simple and secure HTTP API access?

I am currently working on a service which offers a HTTP API for mobile clients. I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be ...
2
votes
1answer
185 views

Session Cookie HttpOnly Set After Initial Server Response Showing as Vulnerable

Is a session cookie set without HttpOnly at first, but added before the client browser finishes rendering, still considered vulnerable? The scanner test I need to satisfy believes so, but is this a ...
6
votes
2answers
674 views

Modern, security-conscious, PHP book?

I posted this on StackOverflow and they redirected me here. Sorry if this isn't the correct area! After creating a simple login system and trying to protect it against things like SQL injection, ...
1
vote
2answers
648 views

Centralize Linux System Management

We currently maintain several linux servers and are looking to employ sub contractors. However, we wan't to keep tabs on who does what on each server. Other then creating sudo accounts on every ...
0
votes
1answer
309 views

How does does the “Sign out all other sessions” feature work in Gmail?

In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they ...
6
votes
3answers
470 views

Vulnerabilities with DB backed session tokens

A user logs in and is given a session token. This token is also stored in a database on the server. The user includes this secret token with each request, and the server will pull it from the DB to ...