Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

learn more… | top users | synonyms

3
votes
1answer
1k views

Requirements for a secure session id?

I'm writing a web service which stores data which will be shared between two separate systems. /session/requestNewSession?args=<data> => returns session id /session/requestArgs?session=<...
3
votes
1answer
76 views

Fear regarding session tokens

I have read recently that sessions work as follows: Your credentials are checked. A token is generated and stored on server side, eg UUID, and this token is given to the client where it is stored ...
3
votes
1answer
109 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
3
votes
1answer
152 views

How can storing a userId as client-side-sessions be safe?

The documentation for session handling in ninjaFramework states: [...] Ninja uses so called client-side sessions. The cookie itself stores the information you want to attach to that session. [....
3
votes
2answers
205 views

What measures must be taken to securely authenticate from web traffic to a WebSocket connection?

Obviously TLS is a must for any and all secure authentication. Please turn your paranoia settings up to 11 for this. Background: (In case people are unfamiliar with the WebSocket (WS) protocol and ...
3
votes
1answer
102 views

At what level does session key entropy become a real-world issue?

Say we have a session key of between 0000000000-9999999999, providing 33.2bits of entropy. This is far short of the 128bits recommended by most. Of course, it is normally trivial to change session ...
3
votes
2answers
272 views

Should a session ID ever be sent over an unencrypted connection?

I'm teaching myself a touch of the most basic information security while toying with web dev, so that I can get a better understanding of the whole picture. Let's assume my website has user accounts ...
3
votes
1answer
292 views

How to run multiple session while scanning application through Burp?

While the scanning the application through Burp, I found that if I use multiple threads it is resulting to session errors like (The requested session id appears to be invalid.You may have more than ...
3
votes
2answers
489 views

Has a HTTP server access to SSL session ID?

I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
3
votes
1answer
228 views

Session Token Embedded in Form

I have a session token that's stored in a browser cookie client side. The cookie is already available for scripting and it's used to validate XHR through Javascript. For a particular page I'm using ...
3
votes
1answer
42 views

Should a corporate laptop client-server VPN connection last for days?

I was experimenting over the past few days with letting my laptop hibernate vs. shutting down on a daily basis (I have always been a shutdown guy, but am trying to update myself). While on business ...
3
votes
1answer
72 views

How to evaluate the security level of session ID generation?

For a few weeks we observed a collision in session ID generation, resulting in two operators independently connected to a test web application sharing the same session. We investigated the issue and ...
3
votes
1answer
127 views

Possible issues when one or more cookie not HttpOnly

I have a question related to HttpOnly cookie. Tracking other threads wasn't of much help, hence I am posting my query here to learn if you can foresee any issues with my understanding. There is a ...
3
votes
2answers
386 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
3
votes
1answer
1k views

Are there modules to harden Symfony 2 sessions?

We're looking at building a new app on top of Symfony 2, but security is our top priority. After digging around a bit, it seems that there are a number of built-in options for Session management (eg ...
3
votes
1answer
63 views

How to prevent data from Interception?

I am a web developer. A few days ago, I used Burp, to intercept facebook's official App over network, by setting up proxy. I noticed that the data was encrypted. While I have been using Json to ...
3
votes
1answer
172 views

SSL session ID in TLS ticket based resumption

We have a server which supports TLS ticket based stateless session resumption. However, when I connect to the server using openssl s_client, I still see a session ID being generated along with the TLS ...
3
votes
1answer
160 views

API which does not allow to invalidate session on server side - how to make it more secure?

I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like logout which will make the cookie my app is using be invalid from now on. ...
3
votes
1answer
72 views

Is it safer to store valuable information on a unsecure client or send the data through the internet?

Background: I'm creating a secure web app with the purpose to act as a no-knowledge storage for small data (we're talking a few bytes). Since all the encryption and decryption happens client-side, ...
3
votes
1answer
230 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
3
votes
1answer
1k views

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...
3
votes
0answers
63 views

How to group user actions within the same session?

I'm working on enterprise application where it's needed to audit all user actions (data modification, settings changing etc.) within their work session. What is the best way to group all that actions ...
3
votes
2answers
327 views

How does a browser manage secure sessions and store session keys?

I am interested in how a browser manages secure sessions. As I understand it this is the scenario when logging into a google account: 1) Browser (B) and google Server (S) perform a handshake to ...
2
votes
3answers
3k views

Why do banking websites always log you out after inactivity?

It seems that every single banking & financial website that I have used logs me out after a certain period of time. Are there a legal requirements or technical reasons for financial sites to do ...
2
votes
3answers
607 views

What do web trackers know about/think of me?

Many companies use HTTP cookies, flash cookies, and other analytics to track visitors on the web and classify them. How can I find out what my web profile is currently, and what these trackers are ...
2
votes
1answer
1k views

SSL/TLS Session Resumption with Session Tickets

We already have SSL session resumption enabled using a session cache. Based on an in-house performance report, enabling Session Resumption using Session Tickets is recommended. Is the performance ...
2
votes
2answers
289 views

safe methods of generating session keys

So I have this web app where I'm supposed to generate my own session key to use in the session manager. I just have few questions about safe approaches to this. I believe to make this safe it should ...
2
votes
2answers
203 views

Enforce a time limit on the number of uploads per user

I've done a lot of searching on SE and particularly here in regards to preventing issues or attacks for an image based website to accept image uploads, but I haven't seen anyone mention the idea of ...
2
votes
4answers
846 views

When logging out of a website is anything else required then destroying the session?

In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out. session_start(); session_destroy(); Is there anything else that needs to be done? EDIT: I ...
2
votes
2answers
538 views

How attacker can access victim's account without knowing its credentials?

I want to login facebook from a wifi connection and check sign-in page is over https but later when i don't pay attention to address bar (for example when playing games and click on links like a crazy ...
2
votes
3answers
4k views

Determining a reasonable session timeout limit [closed]

What's a resonable session timeout limit and how can you determine it?
2
votes
1answer
47 views

Cross-domain session standardization

I am looking into cross-domain sessions. These are sessions which are shared between two domains like google.com and spotify.com. I'm not looking for information regarding cross-domain sessions ...
2
votes
1answer
94 views

TLS Session Tickets: What is the risk of a disclosed server ticket key?

So there is this TLS Session resumption method using Session Tickets which transfers the TLS server secret state to the client (encrypted and authenticated with a key only known to the server) If a ...
2
votes
2answers
1k views

LDAP Authentication and Sessions

Given a Web Application with Form-based login and a central directory: using LDAP (fast) bind in an application with the actual user has a number of advantages (opposed to using a service user and ...
2
votes
2answers
246 views

On password change in a web application, should it log users out

When a user is logged into a web-based application in multiple tabs, and changes their password should it automatically log them out of the other tabs? The use case is an account is compromised, the ...
2
votes
1answer
877 views

HeartBleed - how do I invalidate all session cookies?

As part of the Heartbleed event, I have upgraded OpenSSL, reissued and replaced certificates and revoked the old ones and changed passwords however, I am also seeing advice to invalidate all session ...
2
votes
4answers
905 views

Session id on page html source code

I want to know if it's dangerous in any way to store the current logged user session id on the page generated source code. Why I wanted to do that? I'm trying to share the user session between two ...
2
votes
1answer
4k views

Stopping Session Hijacking

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
2
votes
1answer
2k views

How to secure MySQL based web session data table?

I have the following MySQL session schema: CREATE TABLE `SessionData` ( `id` varchar(50) COLLATE utf8_unicode_ci NOT NULL, `data` text COLLATE utf8_unicode_ci, `date` datetime DEFAULT NULL, ...
2
votes
1answer
131 views

Can I safely and securely store hash(sessionId) in application logs?

I'm considering storing a hash of a user's session ID in our applications logs on each request. This would allow users sessions to be easily tracked back to actions in our logs. I understand that ...
2
votes
1answer
89 views

Safely sharing session accross sub-domains

So I have a web service that is to be split up over several sub-domains. So app1.xyz.com and app2.xyz.com. Because Safari (last time I checked) does not allow for cookies to be shared across sub-...
2
votes
1answer
295 views

Single Page Application session management

I have a Single Page Application which is fully HTML+JS+CSS (using frameworks such as jQuery and AngularJS) and a server side API using ASP.NET WebApi. The SPA is served in a server similar to a CDN ...
2
votes
2answers
356 views

Why does OWASP recommend “Disable Web Browser Cross-Tab Sessions”

I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same ...
2
votes
3answers
1k views

Passing session id in query string to maintain state in third party iframe - good practice?

I would like to allow the user to be "logged in" and maintain state / logged in status between pages within an iframe. The iframe content is ours, and will be hosted on various clients' websites. ...
2
votes
2answers
548 views

Can sessions be handled securely with cookies disabled?

I've been doing some reading here about session ID handling, and have learned that it's generally a bad idea to include a session ID in the HTML source code, and/or on the query string. For example Is ...
2
votes
1answer
599 views

OpenID Session Fixation with CSRF

This answer describes a situation where CSRF can be used to trick an end user to enter a credit card into another person's Paypal account. It also highlights the fact that state-changing GET requests ...
2
votes
2answers
146 views

Is it bad if session key is passed in plain text in URL?

In a class we were told that it's dangerous to put the session key in the URL because it could be cached, either by the browser or a proxy etc. Is this correct? Even if it was cached shouldn't the ...
2
votes
1answer
97 views

Choosing token over session or vice versa?

I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about: I learned JWT, built a token, and sent ...
2
votes
1answer
666 views

RSA/ECB/PKCS1Padding: Encrypting a Session Key JavaScript

How to do ECB mode when dealing with RSA? I dont understand it. The Aadhar authentication doc (http://uidai.gov.in/images/FrontPageUpdates/aadhaar_authentication_api_1_6.pdf Page 33) says that we have ...
2
votes
1answer
227 views

Can you steal session cookie with BREACH attack?

Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...