Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page. In this ...
Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
I was wondering if anyone knows what the most secure user access plugin for Rails is, and if any of them prevent session fixation?
What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
What are some good practices for ensuring logins, session IDs and session content are secure for a website?