Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

learn more… | top users | synonyms

0
votes
1answer
42 views

SSL session protocol vs SSL connection protocol

Slide 8, SSL Session Protocol: Slide 10, SSL connection protocol: Firstly, in Session Protocol, there is a {S}_B, what is the function of this {S}_B? Does't it help in proving Alice's identity? ...
4
votes
2answers
776 views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
2
votes
1answer
35 views

Cross-domain session standardization

I am looking into cross-domain sessions. These are sessions which are shared between two domains like google.com and spotify.com. I'm not looking for information regarding cross-domain sessions ...
4
votes
2answers
82 views

Is allowing users to sign out of all other sessions good or bad?

I'm not really sure if this feature is a good security idea, but would it be good to allow a user to sign out of all other sessions? Or would this be a bad idea, because I see a good amount of pros, ...
1
vote
3answers
109 views

Asp.net web forms is not generating a new session id if a user logs out and logs back in

Asp.net web forms is not generating a new session id if a user logs out and logs back in. Is this a major security risk? We're using SSL.
8
votes
4answers
1k views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
2
votes
2answers
105 views

Is it bad if session key is passed in plain text in URL?

In a class we were told that it's dangerous to put the session key in the URL because it could be cached, either by the browser or a proxy etc. Is this correct? Even if it was cached shouldn't the ...
1
vote
1answer
26 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
5
votes
2answers
1k views

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
4
votes
1answer
332 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
3
votes
1answer
90 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
1
vote
2answers
106 views

When should server side sessions be used instead of client side sessions?

From an information security perspective, when should server side sessions be enabled instead of client side sessions? From what I gather, "secure client side sessions" are cookies that contain data ...
0
votes
1answer
123 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ...
1
vote
1answer
69 views

Handling session tokens when a users IP changes with extreme frequency

My web service is an API-driven Single-Page-Application. Once the user logs in they're given a temporary token to use for the rest of the session which is sent along with each API request. The token ...
17
votes
3answers
6k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
1
vote
1answer
239 views

Single Page Application session management

I have a Single Page Application which is fully HTML+JS+CSS (using frameworks such as jQuery and AngularJS) and a server side API using ASP.NET WebApi. The SPA is served in a server similar to a CDN ...
21
votes
4answers
23k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
6
votes
3answers
197 views

Getting automatically logged in to others session via Wi-Fi

Recently, I experienced a very strange behaviour on our Wi-Fi network: we share a Wi-Fi network using a simple router. One of us pays the bills and he's the one, who got the management account from ...
14
votes
6answers
2k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
2
votes
2answers
316 views

Why does OWASP recommend “Disable Web Browser Cross-Tab Sessions”

I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same ...
0
votes
4answers
131 views

Is session expiration for all web applications possible?

In case someone visits an infected site his safety, if his cookies get stolen, may be compromised. Is there any abstract way to expire a session on the stolen session-id so that the id is practically ...
2
votes
1answer
91 views

Choosing token over session or vice versa?

I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about: I learned JWT, built a token, and sent ...
1
vote
0answers
47 views

PHP session and page data inconsistencies [closed]

I have a problem and I'm not immediately sure how to go about resolving it. I have been building a secured login system on a HTTPS server (with a grade of "A" by SSL-labs, if that's worth anything ...
2
votes
1answer
631 views

RSA/ECB/PKCS1Padding: Encrypting a Session Key JavaScript

How to do ECB mode when dealing with RSA? I dont understand it. The Aadhar authentication doc (http://uidai.gov.in/images/FrontPageUpdates/aadhaar_authentication_api_1_6.pdf Page 33) says that we have ...
1
vote
1answer
286 views

Session Expiry due to weblogic.xml for mitigation of cookie hijacking? [closed]

To ensure strict security at web application, we tried to mitigate cookie hijacking by adding code to weblogic.xml. Following is what we did: Example that we had applied on weblogic.xml and faced ...
3
votes
1answer
160 views

SSL session ID in TLS ticket based resumption

We have a server which supports TLS ticket based stateless session resumption. However, when I connect to the server using openssl s_client, I still see a session ID being generated along with the TLS ...
34
votes
4answers
21k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first ...
7
votes
3answers
143 views

Are there any severe concerns of sending the user's login and password with each HTTPS request?

Due to certain requirements/constraints, I'm wondering about sending user login and password with each request. This somehow doesn't feel very good to me, though I think for my particular case, it ...
5
votes
4answers
2k views

Using password hash as session ID?

For a rich client web app, on the server I need to verify that each call comes from a legally logged in user. Obviously user ID is not enough, because that's easy to guess. I have an idea I am ...
1
vote
1answer
142 views

cryptographic session token vs stored random session token [duplicate]

I am building a web API and I have a hard time choosing between cryptographic session token and stored random session token for user authentication. I see several pros & cons for each: stored ...
1
vote
2answers
473 views

Differences between Cookie vs Session Variable to sensitive data

I am doing my own login authentication system, and I want to do a robust system. I want to decide which direction I should take to keep the user logged in. I have put a question for each way, and also ...
3
votes
1answer
147 views

How can storing a userId as client-side-sessions be safe?

The documentation for session handling in ninjaFramework states: [...] Ninja uses so called client-side sessions. The cookie itself stores the information you want to attach to that session. ...
4
votes
1answer
343 views

Session Identification Hashing - How to make it more Secure and Robust

I wrote a PHP class which handles Session and store them in DB instead of normal Files in the server, you can find it on My Session Handler Class In that post a user by name @AnotherGuy has raised ...
5
votes
1answer
172 views

Ideal time for cookies to expire?

I get that websites that contain confidential personal information (e.g. banking system) have short sessions and expiration time for cookies for obviously reason. But what are the causes for sites, ...
1
vote
2answers
151 views

Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?

There are several uses for a cookie, and I would like to offer some kind of guarantee that a cookie is being used for a specific, limited purpose and scope. In my case, I want to prove that a cookie ...
5
votes
2answers
191 views

Securely store session data in cookies

I'm trying to create a stateless application server architecture and I would like to store session data in cookies. All pages using the session would be served over HTTPS. I was planning on using ...
3
votes
2answers
185 views

What measures must be taken to securely authenticate from web traffic to a WebSocket connection?

Obviously TLS is a must for any and all secure authentication. Please turn your paranoia settings up to 11 for this. Background: (In case people are unfamiliar with the WebSocket (WS) protocol and ...
1
vote
1answer
77 views

Where are the HTTPS session resumption tickets/sessionIds stored on the client?

With Session resumption in TLS/HTTPS the client stores the sessionID or the session ticket and uses it the next time it wants to communicate with the server. I am trying to find where the browser ...
-1
votes
3answers
1k views

What is the most secure way to save user authentication: Cookies or Session Variable?

I'm developing a web application that is basically for all our employees. Right now we have 3500 employees and all of them will access this web application. All of them will use really confidential ...
3
votes
1answer
153 views

API which does not allow to invalidate session on server side - how to make it more secure?

I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like logout which will make the cookie my app is using be invalid from now on. ...
4
votes
1answer
102 views

How does LDAP keep an authenticated session

I feel like I'm missing something, because I'm not finding an answer Let's have a pretend scenario. I connect to an LDAP server I issues a BIND command and successfully log in (I think the sever ...
24
votes
3answers
6k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
9
votes
1answer
2k views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § ...
0
votes
1answer
41 views

How to verify SSL cerficate If restored session after session broken?

For example: User accessed to my web through SSL wih MYCERT. Suddenly hacker break this session, set proxy between user and my web . User connected again over restored session through HACKERCERT. How ...
1
vote
2answers
709 views

ASP.NET session id strength

After reading this and this, I am wondering if it is considered secure to use the default ASP.NET sessionID as a means to authenticate the user. I know it would be better to implement ASP.Identity, ...
1
vote
2answers
50k views

SSL Handshake failed

I’m working on windows desktop application which is created using C++ (IDE : Qt creator). It has login panel, where i do user validation via https connection using openssl 1.0 library. Application is ...
5
votes
3answers
502 views

Is randomizing cookie names a good idea?

What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
22
votes
2answers
28k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
1
vote
1answer
81 views

Safely sharing session accross sub-domains

So I have a web service that is to be split up over several sub-domains. So app1.xyz.com and app2.xyz.com. Because Safari (last time I checked) does not allow for cookies to be shared across ...
0
votes
0answers
147 views

is Form Authentication more secure than using the session authentication?

Recently I have read about the form authentication of Asp.Net but I can discern no differences in the term of security between it and the session authentication. For Example if somebody hacked my ...