Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

learn more… | top users | synonyms

3
votes
1answer
231 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
1
vote
1answer
324 views

How secure are PHP sessions?

Should i worry about securing PHP sessions for my users? How do hackers steal the sessions? The information users of my site can view is not at all sensitive and if viewed or modified by a hacker ...
1
vote
1answer
157 views

Securing iOS applications communication from client side

Many of you have heard about instagram flaw that facebook has not fixed yet, The flaw allows the attacker to hijack the session by sniffing the session cookie on Instagram iOS app since it does not ...
4
votes
1answer
2k views

CakePHP Set-Cookie Response Header

I am familiar with the cakePHP cookie and session settings but I am unsure as to why (when analyzing through the Burp Proxy Suite I am finding 2 separate Set-Cookie responses: Set-Cookie: DropZone=...
0
votes
2answers
1k views

How session cookies work? [closed]

I want to know the basic working of session cookies. When i tried googling, most of the results came were based on any programming language. I am not good at coding. So it will be helpful if someone ...
9
votes
2answers
6k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
4
votes
2answers
394 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
1
vote
2answers
635 views

Security issues in “Remember Me” function code example

I'm a beginner, and these may be very obvious for you, but I'm trying to understand if there are security issues with this example. Today on Stack Overflow, I saw the following post: PHP Sessions ...
4
votes
3answers
2k views

Clearing/changing session id on logout

While reading through the newes OWASP ASVS standard (still beta) I have found a requirement V2.6 saying Verify that the session id is changed or cleared on logout. I do not see a clear point ...
5
votes
1answer
7k views

Web app with iframe and user - how to deal with session?

We have application which will be in iframe. Partner sites can use our application - put iframe in their sites. Partner site has users with money, who will use our application in iframe to buy items. ...
2
votes
0answers
177 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
2
votes
2answers
274 views

On password change in a web application, should it log users out

When a user is logged into a web-based application in multiple tabs, and changes their password should it automatically log them out of the other tabs? The use case is an account is compromised, the ...
0
votes
1answer
919 views

URL Rewriting vulnerability

We modified our Session handling from cookie based to URL Rewriting. By doing this the session id gets transmitted as part of the URL. Now there is a vulnerability issue, where whoever uses this URL ...
-2
votes
2answers
709 views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
1
vote
2answers
193 views

Does logging out also stops the hijacked session?

Suppose somebody hijacks my session , say using Firesheep. Then what happens if I logout, does the hijacked session also end ? Also, does using LAN wire instead of WiFi prevents session hijacking ?
1
vote
1answer
174 views

Github Pages Security, From .com to .io

Github pages is now using github.io domain instead of github.com I've read github explanation but it's still difficult for me to understand the root cause. Why would a domain become a security issue?
5
votes
1answer
858 views

A Secure Cookie Protocol

As title says I'm trying to implement a secure cookie protocol HMAC(username|expiration name|data|session key, sk) It seams that session key is not constant during whole application session ...
4
votes
1answer
3k views

MITM and replay attacks prevention

I have a client (a mobile app) and a server, the app connects to the server via SSL. The server uses a self-signed certificate, and the client has a file (I'm not entirely sure what, something to do ...
1
vote
1answer
110 views

What can entreprise admins do with our secured sessions?

The enterprise where I work has a proxy server that traces and filters our web activities. Employees claim that they can know the links that we visited and see the content of HTTP web sites, but they ...
1
vote
2answers
184 views

Authenticated sessions and Man in the middle

I see a lot of websites (including Stackoverflow) using this authentication mechanism: Client authenticates under HTTPS and gets back a session id. Client drops back to HTTP and accesses secure ...
0
votes
1answer
156 views

Is session-passing safe?

I have a php and nodejs server. User logs in on the php backend, and, when entering nodejs, the php SID cookie is being passed through a websocket. I further take the session ID, find the session file ...
2
votes
1answer
554 views

Configuration settings for sessions in php

I recently found the following configuration settings: use-strict-mode hash-bits-per-character hash-function and I have some questions about them: Use-strict-mode says the following: session....
0
votes
1answer
205 views

Using encrypted data in session key instead of random

I am writing a service-oriented (REST) application that is (nearly) totally stateless: it can authenticate by API keys, but for web UI it uses the session where it stores nothing but an authenticated ...
7
votes
2answers
3k views

Are my session settings secure enough?

I'm developing a file hosting and sharing web application. Are the following PHP session settings secure enough? ini_set('session.cookie_httponly', 1); ini_set('session.cookie_lifetime', 0); ...
1
vote
0answers
163 views

Passing Encryption Key Across Session for Symmetrically-Encrypted DB

I'm building a database that symmetrically encrypts user data. Nothing super sensitive, I'd use a third-party if it was. The data is encrypted with a surrogate key; the user must enter a password to ...
0
votes
3answers
728 views

Does it have sense a One-Time Session Cookie?

Recently I have faced a site that seems to implement something that we can call "one-time cookie". This cookie is used for single-sign on among different sites. In each request the server sends a Set-...
0
votes
1answer
172 views

Setting a temporary cookie to an invalid value when logout improves security?

When a session is closed, for example, when a timeout triggers or when the user clicks the logout button, the session should be terminated at server side so the session cookie is invalid. I think ...
1
vote
3answers
223 views

Where do suspect requests from logged-in users to my website come from?

I have an ASP.Net MVC 4 web application that is hosted on a Windows 2008 server. The application is secured by a custom ASP.Net membership provider. Only users who are granted permission by the admin ...
0
votes
2answers
3k views

How to scan a website using Nessus with login credentials

I have scanned my website using Nessus.But I need to scan it as logged in user since most of the urls are accessible only if we are logged in.How can I set website login credentials in Nessus?
0
votes
2answers
220 views

Can session data be manipulated without access to source code

When implementing a web-based application, how secure are any session variables against manual manipulation beyond the scope of my code? i.e. when a user is authenticated, if I were to initialise a ...
2
votes
2answers
544 views

How attacker can access victim's account without knowing its credentials?

I want to login facebook from a wifi connection and check sign-in page is over https but later when i don't pay attention to address bar (for example when playing games and click on links like a crazy ...
18
votes
5answers
1k views

Can you secure a web app from FireSheep without using SSL?

Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page. In this ...
1
vote
2answers
669 views

Is it safe to use Diffie-Hellman public keys as nonces to protect against replay attacks?

I have an interesting case regarding protection against replay attacks. Under the assumption that Alice and Bob have used Diffie-Hellman key exchange to establish a secure temporary session, would it ...
2
votes
1answer
888 views

HeartBleed - how do I invalidate all session cookies?

As part of the Heartbleed event, I have upgraded OpenSSL, reissued and replaced certificates and revoked the old ones and changed passwords however, I am also seeing advice to invalidate all session ...
2
votes
3answers
3k views

Why do banking websites always log you out after inactivity?

It seems that every single banking & financial website that I have used logs me out after a certain period of time. Are there a legal requirements or technical reasons for financial sites to do ...
1
vote
0answers
2k views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
1
vote
1answer
658 views

Which approach to encrypting data on a per-user basis is more secure?

As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a per-...
-1
votes
2answers
158 views

Log in security - saving a session [closed]

I am creating a log in system. The easiest system would simply check a database for a log in and password, then same a session var which states login=true I am interested in other things that I can ...
5
votes
3answers
257 views

Best approach for restricting remote ssh session

Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
1
vote
1answer
642 views

Increasing tomcat session id increases security

Tomcat gives a configuration sessionIdLength to be configurable, but does increasing the session id increases its security or its just security through obscurity
-8
votes
4answers
689 views

user authentication my method (reinventing the wheel) is this secure?

I have read many articles advising to use OpenID, including Stack Overflow Q&A, for authentication. Unfortunately I can't use openid because my auth is not based on an email id - it is based on ...
2
votes
2answers
297 views

safe methods of generating session keys

So I have this web app where I'm supposed to generate my own session key to use in the session manager. I just have few questions about safe approaches to this. I believe to make this safe it should ...
0
votes
1answer
215 views

Wouldn't transient cookies for session management increase effectiveness of MITM?

According to wikipedia, a transient cookie (aka session-cookie, in-memory cookie) is forgotten when the user closes the browser. These are also recommended for session cookies by OWASP. I've seen a ...
0
votes
1answer
141 views

How much harm can an attacker do on the Diffie-Hellman exchange?

I'm looking at a system that uses an unprotected Diffie-Hellman exchange to negotiate a key for the session encryption. That Diffie-Hellman is not secure against man-in-the-middle attacks is textbook ...
2
votes
0answers
519 views

What causes wifi network connections to timeout? [closed]

i was wondering what actually causes wifi network connections to timeout. for instance, say my laptop is connected to my wifi and i yank the battery out such that my laptop can't send any proper 802....
1
vote
0answers
989 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
29
votes
1answer
3k views

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value. Example Suppose a user has the ...
2
votes
2answers
562 views

Can sessions be handled securely with cookies disabled?

I've been doing some reading here about session ID handling, and have learned that it's generally a bad idea to include a session ID in the HTML source code, and/or on the query string. For example Is ...
2
votes
4answers
920 views

Session id on page html source code

I want to know if it's dangerous in any way to store the current logged user session id on the page generated source code. Why I wanted to do that? I'm trying to share the user session between two ...
1
vote
3answers
420 views

What additional mitigations are necessary due to “Continue where I left off”?

I work with sensitive sites that handle financial information, my code protects more than four billion pounds of assets. All of our sites have a logout button and in addition use HttpOnly, Secure, ...