Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user
2
votes
2answers
406 views
Is my current method of handling session cookies insecure?
I'm writing a multi-tenant application where accounts are scoped by subdomains. This adds considerable complexity and I'm starting to worry about security.
Each user can have several accounts. For ...
2
votes
1answer
717 views
How to secure MySQL based web session data table?
I have the following MySQL session schema:
CREATE TABLE `SessionData` (
`id` varchar(50) COLLATE utf8_unicode_ci NOT NULL,
`data` text COLLATE utf8_unicode_ci,
`date` datetime DEFAULT NULL,
...
2
votes
3answers
371 views
Session fixation attack
Given the following conditions,
Session ID does not change upon login
Session ID travels in form of HTTP cookie
There is no cross site scripting/redirection vulnerability on the login page
is it ...
2
votes
1answer
497 views
Requirements for a secure session id?
I'm writing a web service which stores data which will be shared between two
separate systems.
/session/requestNewSession?args=<data> => returns session id
...
2
votes
2answers
72 views
Actual issue? Phone switches from 3G to router makes session switch from https to http
I heard that a security issue exists in some cases when a mobile phone has:
Connected to a website via https via 3G
Connects to a router
I'm told that that in this particular scenario the router ...
1
vote
2answers
630 views
How to invalidate a session on browser closure?
I have a web application where web session need to expire after stipulated period of time. However capturing browser closure event is not a good idea to invalidate a user session.
What can be an ...
1
vote
2answers
186 views
Session management: Are the features of application server enough?
HTTP is a stateless protocol. However, when the user logs into a web application, he likes that some session information be preserved, such that he does not have to login again when he wants to go ...
1
vote
3answers
198 views
What typically is the expiration date of a session cookie?
I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
1
vote
1answer
507 views
Stopping Session Hijacking
If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
1
vote
1answer
322 views
Help with scope clarification of PCI requirement 8.5.15
Section 8.5.15 reads:
If a session has been idle for more than 15 minutes, require the user
to re-enter the password to re-activate the terminal.
Section 8 Accompanying note reads:
These ...
1
vote
1answer
126 views
Are there modules to harden Symfony 2 sessions?
We're looking at building a new app on top of Symfony 2, but security is our top priority. After digging around a bit, it seems that there are a number of built-in options for Session management (eg ...
1
vote
2answers
246 views
What is the disadvantages of storing user role including admin in a session variable?
In my projects I always fetch roles from DB and store them in a session variable, then to check If a user has access to admin pages I just check the session.
Let's consider I use a private hosting ...
0
votes
3answers
110 views
Maintain sensitive key between requests
EDIT: Reworked question. Previous version too poorly asked.
On my website users write sensitive messages that must be kept secret.
The entire user area is over SSL, so the communication between user ...
0
votes
2answers
874 views
Is it safe to store password in PHP session?
I need to do some encryptions in the Private zone of my website and I want to use bcrypt with user's password.
Is it safe to store the password in the session when user does the login, so that I can ...
0
votes
3answers
179 views
Is HTTPS necessary for password change if user has already logged in with HTTPS?
I notice many websites implementing HTTPS for changes in account information even though the user has already logged in through HTTPS and tracked by SESSION.
Is this really necessary?
0
votes
3answers
935 views
Determining a reasonable session timeout limit [closed]
What's a resonable session timeout limit and how can you determine it?
0
votes
1answer
62 views
Implementing secure login for an API
I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
0
votes
0answers
47 views
Allow users to vote anonymously *once* [duplicate]
I would like to add functionality to a site which would allow users to view a large collection of articles and cast a vote if they liked the content. Article votes can only be positive (upvoted).
...
0
votes
0answers
138 views
How can I prevent SESSID stealing? [duplicate]
Possible Duplicate:
Can you secure a web app from FireSheep without using SSL?
How can I prevent someone on same network from stealing SESSIONID and using it in his own browser (it would ...
-1
votes
2answers
212 views
Restore session in Firefox
Restore session in Firefox
What does this mean, is it related to the session concept which is stored on the web server?
If I stop the computer with my web-app, and then start it again before the ...
-2
votes
1answer
755 views
Why Gmail logs you out automatically? [closed]
Last few days I have been auto logged out of Gmail. I have not been using any other google related websites on same browser, so there is no chance that I may have logged out from different service.
...
-5
votes
1answer
35 views
What are the valid characters which can be present in a session ID [can it have spaces] [closed]
I need to know what will the valid characters in a session id or in particular whether it can have spaces in it .?
