Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

learn more… | top users | synonyms

0
votes
2answers
111 views

Why not have an identical session cookie for different user's devices?

Here is my table structure: // users +----+--------+------------------------+------------------+-------------------------------+ | id | name | email | cookie | /* some ...
0
votes
2answers
49 views

Remember me vs. persistent session for web applications

This question is intended to gather information about what the specific security advantages/disadvantages are to using a "remember me" function for an online web site relying on sessions compared with ...
7
votes
2answers
980 views

Modern, security-conscious, PHP book?

After creating a simple login system and trying to protect it against things like SQL injection, Session Hijacking, XSS, etc, I've found that I really enjoy doing this type of thing. I'd like to pick ...
34
votes
4answers
21k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
0
votes
1answer
48 views

Is Tomcat session ID generation FIPS compliant?

I am trying to achieve the following security rule server must generate a unique session identifier using a FIPS 140-2 approved random number generator. I am using Tomcat 7.0.68 for my server, I am ...
3
votes
1answer
43 views

Should a corporate laptop client-server VPN connection last for days?

I was experimenting over the past few days with letting my laptop hibernate vs. shutting down on a daily basis (I have always been a shutdown guy, but am trying to update myself). While on business ...
10
votes
3answers
8k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
1
vote
1answer
86 views

How to protect the Session ID?

I have been doing some reading over the past few days on Session IDs and the methods taken to prevent people from intercepting them and using them to hijack a session. From what I have read, when ...
-1
votes
0answers
76 views

What is a WAM style session token?

Does anybody know what a WAM session token is? This appears to be something related to ping-identity; but I am just wondering whether this is a standard or not. If you know about this, please do also ...
0
votes
1answer
130 views

How is UDP hijacking even possible?

My doubt is this: UDP has no sequence numbers, so what indeed is the concept behind UDP session hijacking?
4
votes
0answers
108 views

PHP Session Vulnerability

I'm trying to solve a challenge on a CTF, with PHP sessions. The goal is to make check.php echo $_PASSWORD. I do not have access to the files themselves, and therefore I cannot edit them. My ...
1
vote
1answer
37 views

Risk in not expiring an “unsubscribe” link

Are there any risks with an "unsubscribe" link in e-mails that never expires? The e-mails are sent to customers. The token used to unsubscribe the customer will include a customer ID encoded using ...
2
votes
2answers
146 views

Is it bad if session key is passed in plain text in URL?

In a class we were told that it's dangerous to put the session key in the URL because it could be cached, either by the browser or a proxy etc. Is this correct? Even if it was cached shouldn't the ...
1
vote
1answer
35 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
15
votes
4answers
8k views

Session Hijacking - regenerate session ID

Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
0
votes
1answer
53 views

SSL session protocol vs SSL connection protocol

Slide 8, SSL Session Protocol: Slide 10, SSL connection protocol: Firstly, in Session Protocol, there is a {S}_B, what is the function of this {S}_B? Does't it help in proving Alice's identity? ...
3
votes
1answer
79 views

Fear regarding session tokens

I have read recently that sessions work as follows: Your credentials are checked. A token is generated and stored on server side, eg UUID, and this token is given to the client where it is stored ...
3
votes
2answers
495 views

Has a HTTP server access to SSL session ID?

I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
5
votes
2answers
1k views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
0
votes
1answer
41 views

Site stores cookie name and user id in script tag after login. Is this an issue for either xss or session highjack?

Upfront I will say that this is not my website and that I am simply doing a general audit (for non security issues), but ran across this in the source after logging in. Another script tag for ...
2
votes
1answer
49 views

Cross-domain session standardization

I am looking into cross-domain sessions. These are sessions which are shared between two domains like google.com and spotify.com. I'm not looking for information regarding cross-domain sessions ...
4
votes
2answers
89 views

Is allowing users to sign out of all other sessions good or bad?

I'm not really sure if this feature is a good security idea, but would it be good to allow a user to sign out of all other sessions? Or would this be a bad idea, because I see a good amount of pros, ...
1
vote
3answers
146 views

Asp.net web forms is not generating a new session id if a user logs out and logs back in

Asp.net web forms is not generating a new session id if a user logs out and logs back in. Is this a major security risk? We're using SSL.
8
votes
4answers
1k views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
5
votes
2answers
1k views

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
1
vote
2answers
49 views

Is this a session fixation

I really can't understand the session fixation attack. I've read OWASP definition that said: Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack ...
4
votes
3answers
250 views

CSRF expiring before form submitted

I have a very long web form that could take hours for people to complete. The problem with this is when people take too long the CSRF token expires before they're done and when they hit submit they ...
4
votes
1answer
335 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
3
votes
2answers
182 views

In which OSI layer does session hijacking occur?

In which layer of the OSI model does session hijacking occur? I have performed some research on this, and found that the answer is the transport layer. But is the transport layer not the place ...
3
votes
1answer
64 views

How to prevent data from Interception?

I am a web developer. A few days ago, I used Burp, to intercept facebook's official App over network, by setting up proxy. I noticed that the data was encrypted. While I have been using Json to ...
3
votes
1answer
112 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
1
vote
2answers
155 views

Prevent Session Hijacking, where an attacker steals Session ID(cookie) from the browser physically

Consider a case, where an attacker has physical access of user's machine for 20-30 seconds. The attacker can use this time to steal user's cookie (say using EditThisCookie plugin) and send the cookies ...
1
vote
2answers
130 views

When should server side sessions be used instead of client side sessions?

From an information security perspective, when should server side sessions be enabled instead of client side sessions? From what I gather, "secure client side sessions" are cookies that contain data ...
0
votes
1answer
126 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ("Cache-Control:no-cache"...
1
vote
1answer
83 views

Handling session tokens when a users IP changes with extreme frequency

My web service is an API-driven Single-Page-Application. Once the user logs in they're given a temporary token to use for the rest of the session which is sent along with each API request. The token ...
17
votes
3answers
7k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
1
vote
4answers
152 views

Why is MITM required for Session Hijacking?

As I understand, the basic concept of Session Hijacking is intercepting a packet in which the victim sends its cookie/session credentials to a server, be it Facebook/Twitter/YouTube/Whatever. But ...
0
votes
1answer
79 views

OpenSSL gmail - receiving Please log in via your web browser and then try again

Using openssl as below when I do EHLO auth login and then enter my username and password I get the following error: Please log in via your web browser and then try again. Learn ...
8
votes
3answers
710 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
2
votes
1answer
307 views

Single Page Application session management

I have a Single Page Application which is fully HTML+JS+CSS (using frameworks such as jQuery and AngularJS) and a server side API using ASP.NET WebApi. The SPA is served in a server similar to a CDN ...
5
votes
4answers
445 views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...
21
votes
4answers
23k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
1
vote
1answer
1k views

Is it safe to store the reset password token in PHP session

I have a login system created in PHP. It currently doesn't have the "forgot password" feature and I would like to implement the feature. For this I'm planning to do the following: When user submits ...
3
votes
0answers
63 views

How to group user actions within the same session?

I'm working on enterprise application where it's needed to audit all user actions (data modification, settings changing etc.) within their work session. What is the best way to group all that actions ...
6
votes
3answers
198 views

Getting automatically logged in to others session via Wi-Fi

Recently, I experienced a very strange behaviour on our Wi-Fi network: we share a Wi-Fi network using a simple router. One of us pays the bills and he's the one, who got the management account from ...
14
votes
6answers
2k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
2
votes
0answers
350 views

Session IDs number repeated under mac

I have run a penetration test on a web server. To generate session IDs with this Bash script : #! /bin/bash NUMBEROFSESSIONS=3000 for i in $(seq 1 ${NUMBEROFSESSIONS}) do curl -s -c cookie 'URL' 1&...
0
votes
0answers
21 views

Cookies carrying Session identifiers

Is there a list of names for cookies carrying SID's? For instance: PHP by default uses PHPSESSIONID Tomcat uses JSESSIONID ... I would like to be able to intercepts all SID's supplied via ...
2
votes
2answers
360 views

Why does OWASP recommend “Disable Web Browser Cross-Tab Sessions”

I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same ...
6
votes
2answers
132 views

Tie the session ID to the SSL session

The OWASP website says: Tie the session ID to the SSL session and provide configurable options for actions to take if the session ID is transmitted over a new SSL session. I am not sure if ...