0
votes
2answers
43 views

How session cookies work? [closed]

I want to know the basic working of session cookies. When i tried googling, most of the results came were based on any programming language. I am not good at coding. So it will be helpful if someone ...
7
votes
2answers
222 views

Are my session settings secure enough?

I'm developing a file hosting and sharing web application. Are the following PHP session settings secure enough? ini_set('session.cookie_httponly', 1); ini_set('session.cookie_lifetime', 0); ...
0
votes
1answer
54 views

Setting a temporary cookie to an invalid value when logout improves security?

When a session is closed, for example, when a timeout triggers or when the user clicks the logout button, the session should be terminated at server side so the session cookie is invalid. I think ...
0
votes
3answers
96 views

Does it have sense a One-Time Session Cookie?

Recently I have faced a site that seems to implement something that we can call "one-time cookie". This cookie is used for single-sign on among different sites. In each request the server sends a ...
3
votes
2answers
134 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
6
votes
1answer
166 views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § ...
1
vote
1answer
275 views

Increasing tomcat session id increases security

Tomcat gives a configuration sessionIdLength to be configurable, but does increasing the session id increases its security or its just security through obscurity
1
vote
2answers
194 views

Is it safe to use Diffie-Hellman public keys as nonces to protect against replay attacks?

I have an interesting case regarding protection against replay attacks. Under the assumption that Alice and Bob have used Diffie-Hellman key exchange to establish a secure temporary session, would it ...
2
votes
2answers
159 views

safe methods of generating session keys

So I have this web app where I'm supposed to generate my own session key to use in the session manager. I just have few questions about safe approaches to this. I believe to make this safe it should ...
4
votes
2answers
256 views

What type of information should be shown to an end user for a logon session summary?

Google, Yahoo, Facebook and several banks have a session summary screen that lists a variety of information, but they aren't consistent in what is offered to the end user. e.g. Facebook offers a ...
1
vote
2answers
428 views

How long should a browser session last?

I have two online accounts from different banks, one bank expires my session faster than the other, it's quite annoying. I was wondering how long (or short) should a session be for it to be ...
3
votes
3answers
394 views

Can I safely use an encrypted URL parameter for the session id?

I'm planning to send a user's session ID as a URL parameter which will be AES encrypted. I don't think my app has any link sharing problems. Is this idea feasible? Is it safe?
-6
votes
1answer
261 views

What are the valid characters which can be present in a session ID [can it have spaces] [closed]

I need to know what will the valid characters in a session id or in particular whether it can have spaces in it .?
4
votes
3answers
660 views

Secure login system - using sessions?

I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this: <?php session_start(); if (validPass() || isset($_SESSION['userId'])) { ...