Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

learn more… | top users | synonyms

7
votes
2answers
977 views

Modern, security-conscious, PHP book?

After creating a simple login system and trying to protect it against things like SQL injection, Session Hijacking, XSS, etc, I've found that I really enjoy doing this type of thing. I'd like to pick ...
34
votes
4answers
21k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
3
votes
1answer
42 views

Should a corporate laptop client-server VPN connection last for days?

I was experimenting over the past few days with letting my laptop hibernate vs. shutting down on a daily basis (I have always been a shutdown guy, but am trying to update myself). While on business ...
10
votes
3answers
8k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
1
vote
1answer
35 views

Risk in not expiring an “unsubscribe” link

Are there any risks with an "unsubscribe" link in e-mails that never expires? The e-mails are sent to customers. The token used to unsubscribe the customer will include a customer ID encoded using ...
2
votes
2answers
145 views

Is it bad if session key is passed in plain text in URL?

In a class we were told that it's dangerous to put the session key in the URL because it could be cached, either by the browser or a proxy etc. Is this correct? Even if it was cached shouldn't the ...
1
vote
1answer
33 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
14
votes
4answers
8k views

Session Hijacking - regenerate session ID

Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
0
votes
1answer
53 views

SSL session protocol vs SSL connection protocol

Slide 8, SSL Session Protocol: Slide 10, SSL connection protocol: Firstly, in Session Protocol, there is a {S}_B, what is the function of this {S}_B? Does't it help in proving Alice's identity? ...
5
votes
2answers
1k views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
2
votes
1answer
47 views

Cross-domain session standardization

I am looking into cross-domain sessions. These are sessions which are shared between two domains like google.com and spotify.com. I'm not looking for information regarding cross-domain sessions ...
4
votes
2answers
89 views

Is allowing users to sign out of all other sessions good or bad?

I'm not really sure if this feature is a good security idea, but would it be good to allow a user to sign out of all other sessions? Or would this be a bad idea, because I see a good amount of pros, ...
1
vote
3answers
139 views

Asp.net web forms is not generating a new session id if a user logs out and logs back in

Asp.net web forms is not generating a new session id if a user logs out and logs back in. Is this a major security risk? We're using SSL.
8
votes
4answers
1k views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
5
votes
2answers
1k views

Is HTML5 sessionStorage secure for temporarily storing a cryptographic key?

Assume I am building a local web application (e.g. browser extension) in HTML5 to encrypt a database locally. Access to the database is controlled by a password and a cryptographic master key is ...
4
votes
1answer
335 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
3
votes
1answer
109 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
1
vote
2answers
125 views

When should server side sessions be used instead of client side sessions?

From an information security perspective, when should server side sessions be enabled instead of client side sessions? From what I gather, "secure client side sessions" are cookies that contain data ...
0
votes
1answer
126 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ("Cache-Control:no-cache"...
1
vote
1answer
80 views

Handling session tokens when a users IP changes with extreme frequency

My web service is an API-driven Single-Page-Application. Once the user logs in they're given a temporary token to use for the rest of the session which is sent along with each API request. The token ...
17
votes
3answers
7k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
2
votes
1answer
294 views

Single Page Application session management

I have a Single Page Application which is fully HTML+JS+CSS (using frameworks such as jQuery and AngularJS) and a server side API using ASP.NET WebApi. The SPA is served in a server similar to a CDN ...
21
votes
4answers
23k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
6
votes
3answers
198 views

Getting automatically logged in to others session via Wi-Fi

Recently, I experienced a very strange behaviour on our Wi-Fi network: we share a Wi-Fi network using a simple router. One of us pays the bills and he's the one, who got the management account from ...
14
votes
6answers
2k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
2
votes
2answers
355 views

Why does OWASP recommend “Disable Web Browser Cross-Tab Sessions”

I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same ...
0
votes
4answers
140 views

Is session expiration for all web applications possible?

In case someone visits an infected site his safety, if his cookies get stolen, may be compromised. Is there any abstract way to expire a session on the stolen session-id so that the id is practically ...
2
votes
1answer
97 views

Choosing token over session or vice versa?

I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about: I learned JWT, built a token, and sent ...
1
vote
0answers
48 views

PHP session and page data inconsistencies [closed]

I have a problem and I'm not immediately sure how to go about resolving it. I have been building a secured login system on a HTTPS server (with a grade of "A" by SSL-labs, if that's worth anything ),...
2
votes
1answer
661 views

RSA/ECB/PKCS1Padding: Encrypting a Session Key JavaScript

How to do ECB mode when dealing with RSA? I dont understand it. The Aadhar authentication doc (http://uidai.gov.in/images/FrontPageUpdates/aadhaar_authentication_api_1_6.pdf Page 33) says that we have ...
1
vote
1answer
300 views

Session Expiry due to weblogic.xml for mitigation of cookie hijacking? [closed]

To ensure strict security at web application, we tried to mitigate cookie hijacking by adding code to weblogic.xml. Following is what we did: Example that we had applied on weblogic.xml and faced ...
3
votes
1answer
172 views

SSL session ID in TLS ticket based resumption

We have a server which supports TLS ticket based stateless session resumption. However, when I connect to the server using openssl s_client, I still see a session ID being generated along with the TLS ...
7
votes
3answers
145 views

Are there any severe concerns of sending the user's login and password with each HTTPS request?

Due to certain requirements/constraints, I'm wondering about sending user login and password with each request. This somehow doesn't feel very good to me, though I think for my particular case, it ...
5
votes
4answers
2k views

Using password hash as session ID?

For a rich client web app, on the server I need to verify that each call comes from a legally logged in user. Obviously user ID is not enough, because that's easy to guess. I have an idea I am ...
1
vote
1answer
147 views

cryptographic session token vs stored random session token [duplicate]

I am building a web API and I have a hard time choosing between cryptographic session token and stored random session token for user authentication. I see several pros & cons for each: stored ...
1
vote
2answers
484 views

Differences between Cookie vs Session Variable to sensitive data

I am doing my own login authentication system, and I want to do a robust system. I want to decide which direction I should take to keep the user logged in. I have put a question for each way, and also ...
3
votes
1answer
152 views

How can storing a userId as client-side-sessions be safe?

The documentation for session handling in ninjaFramework states: [...] Ninja uses so called client-side sessions. The cookie itself stores the information you want to attach to that session. [....
4
votes
1answer
361 views

Session Identification Hashing - How to make it more Secure and Robust

I wrote a PHP class which handles Session and store them in DB instead of normal Files in the server, you can find it on My Session Handler Class In that post a user by name @AnotherGuy has raised ...
5
votes
1answer
191 views

Ideal time for cookies to expire?

I get that websites that contain confidential personal information (e.g. banking system) have short sessions and expiration time for cookies for obviously reason. But what are the causes for sites, ...
1
vote
2answers
161 views

Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?

There are several uses for a cookie, and I would like to offer some kind of guarantee that a cookie is being used for a specific, limited purpose and scope. In my case, I want to prove that a cookie ...
5
votes
2answers
216 views

Securely store session data in cookies

I'm trying to create a stateless application server architecture and I would like to store session data in cookies. All pages using the session would be served over HTTPS. I was planning on using ...
3
votes
2answers
205 views

What measures must be taken to securely authenticate from web traffic to a WebSocket connection?

Obviously TLS is a must for any and all secure authentication. Please turn your paranoia settings up to 11 for this. Background: (In case people are unfamiliar with the WebSocket (WS) protocol and ...
1
vote
1answer
83 views

Where are the HTTPS session resumption tickets/sessionIds stored on the client?

With Session resumption in TLS/HTTPS the client stores the sessionID or the session ticket and uses it the next time it wants to communicate with the server. I am trying to find where the browser ...
-1
votes
3answers
1k views

What is the most secure way to save user authentication: Cookies or Session Variable?

I'm developing a web application that is basically for all our employees. Right now we have 3500 employees and all of them will access this web application. All of them will use really confidential ...
3
votes
1answer
160 views

API which does not allow to invalidate session on server side - how to make it more secure?

I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like logout which will make the cookie my app is using be invalid from now on. ...
4
votes
1answer
107 views

How does LDAP keep an authenticated session

I feel like I'm missing something, because I'm not finding an answer Let's have a pretend scenario. I connect to an LDAP server I issues a BIND command and successfully log in (I think the sever ...
24
votes
3answers
7k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
9
votes
1answer
3k views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § 2....
0
votes
1answer
41 views

How to verify SSL cerficate If restored session after session broken?

For example: User accessed to my web through SSL wih MYCERT. Suddenly hacker break this session, set proxy between user and my web . User connected again over restored session through HACKERCERT. How ...
1
vote
2answers
743 views

ASP.NET session id strength

After reading this and this, I am wondering if it is considered secure to use the default ASP.NET sessionID as a means to authenticate the user. I know it would be better to implement ASP.Identity, ...