Tagged Questions
2
votes
4answers
264 views
When logging out of a website is anything else required then destroying the session?
In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out.
session_start();
session_destroy();
Is there anything else that needs to be done?
EDIT: I ...
4
votes
2answers
296 views
Best way to securely set a session cookie on another domain
We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com.
The www site does not have an SSL certificate and is on a different domain.
We have a login button on http://www.foo.co.uk ...
1
vote
2answers
183 views
Session management: Are the features of application server enough?
HTTP is a stateless protocol. However, when the user logs into a web application, he likes that some session information be preserved, such that he does not have to login again when he wants to go ...
15
votes
1answer
837 views
What cookie attacks are possible between computers in related DNS domains (*.example.com)?
Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value.
Example
Suppose a user has the ...
5
votes
4answers
689 views
Using password hash as session ID?
For a rich client web app, on the server I need to verify that each call comes from a legally logged in user. Obviously user ID is not enough, because that's easy to guess.
I have an idea I am ...
0
votes
0answers
138 views
How can I prevent SESSID stealing? [duplicate]
Possible Duplicate:
Can you secure a web app from FireSheep without using SSL?
How can I prevent someone on same network from stealing SESSIONID and using it in his own browser (it would ...
12
votes
6answers
525 views
Is This Login Security Enough?
I'm coming up with my next login system for admins of an ecommerce website to have
login form is SSL secured
password is converted to sha256 before being transmitted (bcrypt is too slow still for ...
4
votes
2answers
264 views
Attack vectors in POSTing variables from one php script to the next?
I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as ...
15
votes
4answers
2k views
How to hijack a session?
Despite the blatant title of the question, this is actually for a genuine purpose.
My site uses PHP code like this:
$select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'";
...
3
votes
3answers
774 views
Altering a $_SESSION variable in PHP via XSS?
Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script?
One of our scripts uses a $_SESSION variable and I'm not sure if ...
9
votes
4answers
2k views
Session Hijacking - regenerate session ID
Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing?
I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
3
votes
1answer
143 views
Security of rails user access/permissions plugins
I was wondering if anyone knows what the most secure user access plugin for Rails is, and if any of them prevent session fixation?
5
votes
3answers
267 views
Is randomizing cookie names a good idea?
What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
