Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

learn more… | top users | synonyms

86
votes
8answers
8k views

Do we need to logout of webapps?

A quick Google search doesn't reveal whether it is important to logout of webapps (online banking, Amazon, Facebook, etc.), or if I am safe just closing the tab or browser. I am sure I heard on some ...
35
votes
4answers
21k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
34
votes
5answers
10k views

Why do you need to close your browser window after logging out of a website?

I might be wrong, but I believe the request to close the browser window after logging out is common, though it's completely unclear what the risks might be of failing to close a browser window (...
29
votes
1answer
3k views

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value. Example Suppose a user has the ...
29
votes
2answers
36k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
26
votes
4answers
13k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
25
votes
3answers
7k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
22
votes
4answers
24k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
21
votes
4answers
10k views

Why users want to disable cookies?

I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
20
votes
5answers
3k views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
18
votes
5answers
1k views

Can you secure a web app from FireSheep without using SSL?

Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page. In this ...
17
votes
3answers
7k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
15
votes
4answers
8k views

Session Hijacking - regenerate session ID

Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
14
votes
6answers
2k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
14
votes
3answers
18k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
14
votes
2answers
1k views

Does it make sense to hash a session id before passing it to an advertisement partner?

My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
13
votes
3answers
7k views

How does FaceNiff work?

FaceNiff is an Android app that sniffs Facebook session ids. You must be connected to the same WiFi as the victim. It is said to be working even when WPA2 is present. How is it possible? I can decrypt ...
12
votes
2answers
19k views

OAuth access token vs session key

Is there any advantage to OAuth vs cookie-based sessions (established via username/password) under the following assumptions? There is only one legitimate client to the service The OAuth client ...
11
votes
2answers
4k views

Session Cookie Stealing Protection

I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used: HTTPS Everywhere Only use a securely created random ...
11
votes
3answers
8k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
11
votes
1answer
834 views

Webapp2 security

I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and webapp2_extras....
9
votes
2answers
3k views

How is the session ID sent securely?

I'm learning session management and I have two questions for which I could not find answers on the web. Once the user is authenticated, the server creates the Session ID and sends it to the client (...
9
votes
1answer
3k views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § 2....
9
votes
2answers
6k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
8
votes
5answers
3k views

What do the various browser “private modes” do?

Recently there has been some disagreement as to what "private mode" means when it comes to various browsers. Primarily I am referring to... IE's "InPrivate Browsing" Google Chrome's "Incognito ...
8
votes
4answers
1k views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
8
votes
5answers
831 views

Should a user have the ability to be logged in from multiple locations at the same time?

In the past, I've always used a single session per user setup, but I'm working on a project now where a user can be signed in from multiple locations/browsers at the same time. What are the security ...
8
votes
3answers
747 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
7
votes
3answers
11k views

Is it safe to store password in HTML5 sessionStorage?

I am trying to improve the user experience on registration by not requiring the user to retype their password if validation on other fields fail. There are a few ways to implement this, example using ...
7
votes
2answers
4k views

Is it possible to force a new SSL session

Using tools like Wireshark, it's possible to decrypt SSL traffic as the client by logging the (pre)master secret, without using a mitm attack or the server's private key. But I found that for some ...
7
votes
2answers
3k views

Are my session settings secure enough?

I'm developing a file hosting and sharing web application. Are the following PHP session settings secure enough? ini_set('session.cookie_httponly', 1); ini_set('session.cookie_lifetime', 0); ...
7
votes
2answers
992 views

Modern, security-conscious, PHP book?

After creating a simple login system and trying to protect it against things like SQL injection, Session Hijacking, XSS, etc, I've found that I really enjoy doing this type of thing. I'd like to pick ...
7
votes
3answers
147 views

Are there any severe concerns of sending the user's login and password with each HTTPS request?

Due to certain requirements/constraints, I'm wondering about sending user login and password with each request. This somehow doesn't feel very good to me, though I think for my particular case, it ...
6
votes
3answers
10k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
6
votes
3answers
731 views

Vulnerabilities with DB backed session tokens

A user logs in and is given a session token. This token is also stored in a database on the server. The user includes this secret token with each request, and the server will pull it from the DB to ...
6
votes
3answers
198 views

Getting automatically logged in to others session via Wi-Fi

Recently, I experienced a very strange behaviour on our Wi-Fi network: we share a Wi-Fi network using a simple router. One of us pays the bills and he's the one, who got the management account from ...
6
votes
1answer
11k views

Where and How is data stored in a session?

Where is the information in the fields of a session stored? If I, for instance, store in a session something like $_SESSION['foo'] = 'bar'. Where is "bar" stored? If I store an object of a class, in ...
6
votes
3answers
797 views

What is the state of the art for forcing logout on browser quit?

Background: Most browsers have implemented some form of "Session Restore" functionality as a convenience to users where, if enabled, session cookies will be persisted across browser restarts. ...
6
votes
2answers
144 views

Tie the session ID to the SSL session

The OWASP website says: Tie the session ID to the SSL session and provide configurable options for actions to take if the session ID is transmitted over a new SSL session. I am not sure if ...
5
votes
4answers
2k views

Using password hash as session ID?

For a rich client web app, on the server I need to verify that each call comes from a legally logged in user. Obviously user ID is not enough, because that's easy to guess. I have an idea I am ...
5
votes
4answers
3k views

Use cookies once stolen

I have seen many posts about stealing cookies, as a matter of fact I have taken advantage of the XSS vulnerability to send the cookie to my php through a variable in the url to a php, and that php ...
5
votes
3answers
516 views

Is randomizing cookie names a good idea?

What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
5
votes
3answers
21k views

What typically is the expiration date of a session cookie?

I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
5
votes
3answers
219 views

Is my Google session safe when my computer is logged out or locked?

I've recently uploaded all the family photos to my Google Drive account. I have a strong password and 2 step verification enabled on my Google account. My home computer is (naturally) trusted and ...
5
votes
2answers
167 views

What are the tradeoffs in allowing logouts of other logged-in sessions?

For instance, Gmail has allowed remote logout since 2008. I think I have seen other sites that allow you to log out all other logged-in sessions. What are the tradeoffs to consider in this session ...
5
votes
4answers
3k views

Can a session be hijacked if the user is redirected from HTTPS to HTTP after login?

I am developing a web app, which makes HTTP calls as long as the user is not logged in. Once the user clicks the login button, he is sent to a "login page" that is HTTPS. The login makes an Ajax call ...
5
votes
3answers
257 views

Best approach for restricting remote ssh session

Using the following files, I have attempted to restrict the SSH remote login. Having lack of knowledge in linux environment, I don't know the drawbacks and vulnerabilities between the following ways. ...
5
votes
2answers
7k views

Is it safe to store password in PHP session?

I need to do some encryptions in the private zone of my website and I want to bcrypt the user's password. Is it safe to store the password in the session when user does the login, so that I can use ...
5
votes
2answers
1k views

Session Hijacking through sessionId brute-forcing possible?

cookies usually contain a sessionId to keep track of a logged user. What would prevent a malicious user to forge millions of requests with random sessionIds and send them to a server, hoping to ...
5
votes
1answer
5k views

Will session_regenerate_id() without true parameter improves security? Should I use it right before login?

I want to decrease session fixation attack vulnerability, hence I used session_regenerate_id() before login. Somehow I'm in dark now and not sure the right answer for questions below: When we don'...