Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

learn more… | top users | synonyms

1
vote
2answers
775 views

What is the disadvantages of storing user role including admin in a session variable?

In my projects I always fetch roles from DB and store them in a session variable, then to check If a user has access to admin pages I just check the session. Let's consider I use a private hosting ...
1
vote
2answers
649 views

Centralize Linux System Management

We currently maintain several linux servers and are looking to employ sub contractors. However, we wan't to keep tabs on who does what on each server. Other then creating sudo accounts on every ...
0
votes
3answers
180 views

Maintain sensitive key between requests

EDIT: Reworked question. Previous version too poorly asked. On my website users write sensitive messages that must be kept secret. The entire user area is over SSL, so the communication between user ...
0
votes
2answers
277 views

Are there any HTTP servers that can detect two cookies with the same name, but issued from different subdomains?

As a follow up to the Related Domain Cookie Attack question, I'd like to see if there are any servers that are able to detect instances where multiple cookies are sent from multiple domains. In other ...
0
votes
2answers
23k views

SSL Handshake failed

I’m working on windows desktop application which is created using C++ (IDE : Qt creator). It has login panel, where i do user validation via https connection using openssl 1.0 library. Application is ...
0
votes
3answers
225 views

Is HTTPS necessary for password change if user has already logged in with HTTPS?

I notice many websites implementing HTTPS for changes in account information even though the user has already logged in through HTTPS and tracked by SESSION. Is this really necessary?
0
votes
3answers
3k views

Determining a reasonable session timeout limit [closed]

What's a resonable session timeout limit and how can you determine it?
0
votes
1answer
85 views

Setting a temporary cookie to an invalid value when logout improves security?

When a session is closed, for example, when a timeout triggers or when the user clicks the logout button, the session should be terminated at server side so the session cookie is invalid. I think ...
0
votes
1answer
309 views

How does does the “Sign out all other sessions” feature work in Gmail?

In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they ...
0
votes
1answer
122 views

Implementing secure login for an API

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
0
votes
2answers
200 views

How session cookies work? [closed]

I want to know the basic working of session cookies. When i tried googling, most of the results came were based on any programming language. I am not good at coding. So it will be helpful if someone ...
0
votes
3answers
227 views

Does it have sense a One-Time Session Cookie?

Recently I have faced a site that seems to implement something that we can call "one-time cookie". This cookie is used for single-sign on among different sites. In each request the server sends a ...
0
votes
1answer
301 views

Which approach to encrypting data on a per-user basis is more secure?

As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a ...
0
votes
1answer
410 views

What mechanism to use for simple and secure HTTP API access?

I am currently working on a service which offers a HTTP API for mobile clients. I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be ...
0
votes
0answers
54 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
0
votes
0answers
152 views

session management and login php scripts

I want to to write login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. There are password protected control panels in abundance, ...
0
votes
0answers
28 views

Securing php session using extra settings [duplicate]

I have googling on securing php session and came across this link http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL where they suggest to start like this as below. $session_name ...
0
votes
1answer
113 views

Using encrypted data in session key instead of random

I am writing a service-oriented (REST) application that is (nearly) totally stateless: it can authenticate by API keys, but for web UI it uses the session where it stores nothing but an authenticated ...
0
votes
1answer
145 views

Wouldn't transient cookies for session management increase effectiveness of MITM?

According to wikipedia, a transient cookie (aka session-cookie, in-memory cookie) is forgotten when the user closes the browser. These are also recommended for session cookies by OWASP. I've seen a ...
0
votes
0answers
138 views

How can I prevent SESSID stealing? [duplicate]

Possible Duplicate: Can you secure a web app from FireSheep without using SSL? How can I prevent someone on same network from stealing SESSIONID and using it in his own browser (it would ...
-1
votes
2answers
342 views

Restore session in Firefox

Restore session in Firefox What does this mean, is it related to the session concept which is stored on the web server? If I stop the computer with my web-app, and then start it again before the ...
-6
votes
4answers
318 views

user authentication my method (reinventing the wheel) is this secure?

I have read many articles advising to use OpenID, including Stack Overflow Q&A, for authentication. Unfortunately I can't use openid because my auth is not based on an email id - it is based on ...
-6
votes
1answer
332 views

What are the valid characters which can be present in a session ID [can it have spaces] [closed]

I need to know what will the valid characters in a session id or in particular whether it can have spaces in it .?