Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user
3
votes
1answer
70 views
Session Cookie Stealing Protection
I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used:
HTTPS Everywhere
Only use a securely created random ...
2
votes
3answers
108 views
Can I safely use an encrypted URL parameter for the session id?
I'm planning to send a user's session ID as a URL parameter which will be AES encrypted. I don't think my app has any link sharing problems. Is this idea feasible? Is it safe?
5
votes
2answers
158 views
What are the tradeoffs in allowing logouts of other logged-in sessions?
For instance, Gmail has allowed remote logout since 2008. I think I have seen other sites that allow you to log out all other logged-in sessions.
What are the tradeoffs to consider in this session ...
3
votes
3answers
133 views
Does the ability for a user to choose the value of a session id cookie constitute a security flaw?
In the context of a web application, a user connects to this application and a session id cookie is set to authenticate the user for next requests. As the cookie is actually present before submitting ...
-5
votes
1answer
35 views
What are the valid characters which can be present in a session ID [can it have spaces] [closed]
I need to know what will the valid characters in a session id or in particular whether it can have spaces in it .?
4
votes
0answers
112 views
Webapp2 security
I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and ...
3
votes
3answers
594 views
Choosing a session ID algorithm for a client-server relationship
I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
2
votes
3answers
153 views
Secure login system - using sessions?
I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this:
<?php
session_start();
if (validPass() || isset($_SESSION['userId'])) {
...
1
vote
3answers
201 views
What typically is the expiration date of a session cookie?
I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
-1
votes
2answers
212 views
Restore session in Firefox
Restore session in Firefox
What does this mean, is it related to the session concept which is stored on the web server?
If I stop the computer with my web-app, and then start it again before the ...
15
votes
4answers
2k views
How to hijack a session?
Despite the blatant title of the question, this is actually for a genuine purpose.
My site uses PHP code like this:
$select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'";
...
0
votes
1answer
62 views
Implementing secure login for an API
I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
2
votes
4answers
264 views
When logging out of a website is anything else required then destroying the session?
In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out.
session_start();
session_destroy();
Is there anything else that needs to be done?
EDIT: I ...
2
votes
2answers
72 views
Actual issue? Phone switches from 3G to router makes session switch from https to http
I heard that a security issue exists in some cases when a mobile phone has:
Connected to a website via https via 3G
Connects to a router
I'm told that that in this particular scenario the router ...
0
votes
0answers
47 views
Allow users to vote anonymously *once* [duplicate]
I would like to add functionality to a site which would allow users to view a large collection of articles and cast a vote if they liked the content. Article votes can only be positive (upvoted).
...
9
votes
4answers
910 views
Demystifying Web Authentication (Stateless Session Cookies)
I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages.
Here is my first ...
5
votes
3answers
267 views
Is randomizing cookie names a good idea?
What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
4
votes
1answer
1k views
OAuth access token vs session key
Is there any advantage to OAuth vs cookie-based sessions (established via username/password) under the following assumptions?
There is only one legitimate client to the service
The OAuth client ...
3
votes
4answers
171 views
Securing opensource web application
I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
1
vote
1answer
127 views
Are there modules to harden Symfony 2 sessions?
We're looking at building a new app on top of Symfony 2, but security is our top priority. After digging around a bit, it seems that there are a number of built-in options for Session management (eg ...
0
votes
3answers
110 views
Maintain sensitive key between requests
EDIT: Reworked question. Previous version too poorly asked.
On my website users write sensitive messages that must be kept secret.
The entire user area is over SSL, so the communication between user ...
4
votes
2answers
168 views
Any real world examples of GPS location data being used with authentication?
Are there any examples of how GPS coordinate (or any location data really) can be used to detect suspicious locations or validate well known locations?
Specifically
Highlighting new or unusual ...
7
votes
2answers
668 views
Keeping user session alive - security considerations
We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
1
vote
1answer
508 views
Stopping Session Hijacking
If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
4
votes
3answers
116 views
Getting automatically logged in to others session via WIFI
Recently i got a very strange behavior on our WIFI network: We share a WIFI network with a simple router. One of us pays the bills and he's the one, who got the management account from our ISP. So if ...
6
votes
3answers
903 views
CSRF cookie vs session based tokens
I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie.
Is it ...
4
votes
2answers
303 views
Best way to securely set a session cookie on another domain
We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com.
The www site does not have an SSL certificate and is on a different domain.
We have a login button on http://www.foo.co.uk ...
2
votes
2answers
148 views
How attacker can access victim's account without knowing its credentials?
I want to login facebook from a wifi connection and check sign-in page is over https but later when i don't pay attention to address bar (for example when playing games and click on links like a crazy ...
-2
votes
1answer
761 views
Why Gmail logs you out automatically? [closed]
Last few days I have been auto logged out of Gmail. I have not been using any other google related websites on same browser, so there is no chance that I may have logged out from different service.
...
1
vote
2answers
630 views
How to invalidate a session on browser closure?
I have a web application where web session need to expire after stipulated period of time. However capturing browser closure event is not a good idea to invalidate a user session.
What can be an ...
4
votes
1answer
242 views
A Secure Cookie Protocol
As title says I'm trying to implement a secure cookie protocol
HMAC(username|expiration name|data|session key, sk)
It seams that session key is not constant during whole application session ...
12
votes
4answers
1k views
Why users want to disable cookies?
I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
6
votes
1answer
2k views
Is windows 7 vulnerable to null session?
My lecturer told me that Windows 7 is not vulnerable to null session but did not explain why. What is the preventive measure that windows 7 did to protect against from it?
The recommend fixes for ...
3
votes
1answer
351 views
Where and How is data stored in a session?
Where is the information in the fields of a session stored? If I, for instance, store in a session something like $_SESSION['foo'] = 'bar'. Where is "bar" stored?
If I store an object of a class, in ...
0
votes
2answers
877 views
Is it safe to store password in PHP session?
I need to do some encryptions in the Private zone of my website and I want to use bcrypt with user's password.
Is it safe to store the password in the session when user does the login, so that I can ...
3
votes
3answers
1k views
Do you need to encrypt session data?
I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
10
votes
3answers
1k views
What risks do Cookieless sessions have? What are the mitigations?
I'm debating if I should support cookieless sessions in my web app. It would look something like this:
http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx
Since the URL is never ...
1
vote
2answers
186 views
Session management: Are the features of application server enough?
HTTP is a stateless protocol. However, when the user logs into a web application, he likes that some session information be preserved, such that he does not have to login again when he wants to go ...
3
votes
1answer
253 views
OpenID Session Fixation with CSRF
This answer describes a situation where CSRF can be used to trick an end user to enter a credit card into another person's Paypal account. It also highlights the fact that state-changing GET requests ...
2
votes
3answers
371 views
Session fixation attack
Given the following conditions,
Session ID does not change upon login
Session ID travels in form of HTTP cookie
There is no cross site scripting/redirection vulnerability on the login page
is it ...
2
votes
1answer
719 views
How to secure MySQL based web session data table?
I have the following MySQL session schema:
CREATE TABLE `SessionData` (
`id` varchar(50) COLLATE utf8_unicode_ci NOT NULL,
`data` text COLLATE utf8_unicode_ci,
`date` datetime DEFAULT NULL,
...
7
votes
5answers
839 views
What do the various browser “private modes” do?
Recently there has been some disagreement as to what "private mode" means when it comes to various browsers.
Primarily I am referring to...
IE's "InPrivate Browsing"
Google Chrome's "Incognito ...
3
votes
1answer
810 views
Will session_regenerate_id() without true parameter improves security? Should I use it right before login?
I want to decrease session fixation attack vulnerability, hence I used session_regenerate_id() before login. Somehow I'm in dark now and not sure the right answer for questions below:
When we ...
2
votes
4answers
656 views
Can a session be hijacked if the user is redirected from HTTPS to HTTP after login?
I am developing a web app, which makes HTTP calls as long as the user is not logged in.
Once the user clicks the login button, he is sent to a "login page" that is HTTPS.
The login makes an Ajax call ...
2
votes
2answers
407 views
Is my current method of handling session cookies insecure?
I'm writing a multi-tenant application where accounts are scoped by subdomains. This adds considerable complexity and I'm starting to worry about security.
Each user can have several accounts. For ...
5
votes
3answers
558 views
How do I protect myself against 'hole 196'?
I came across this question a while ago and read about hole 196.
Is there something I can install on my laptop to protect it against WPA2 Hole196?
Software (such as Snort or DecaffeintID) can ...
1
vote
2answers
246 views
What is the disadvantages of storing user role including admin in a session variable?
In my projects I always fetch roles from DB and store them in a session variable, then to check If a user has access to admin pages I just check the session.
Let's consider I use a private hosting ...
2
votes
1answer
500 views
Requirements for a secure session id?
I'm writing a web service which stores data which will be shared between two
separate systems.
/session/requestNewSession?args=<data> => returns session id
...
4
votes
1answer
473 views
Is this admin area secure enough? V2
This is a response to my previous question, Is this admin area secure enough?.
There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
3
votes
3answers
317 views
Is this admin area secure enough?
EDIT: Please view the revised question instead
The admin area has special access to the database (modifying orders, etc).
To help explain, I drew a diagram, so here is my process:
Notes:
I ...
