New answers tagged

4

I'm a bit confused about your vernacular. But I'll try. I believe you are using the word "session" to refer to single sign-on (SSO). This is functionality that allows you to sign into one site and have that sign-on propagated to other sites without requiring re-authentication. There are several standards for this. They include OAuth1, SAML, and OpenID ...


3

Having the ability to terminate all sessions that exist for a certain account is a good idea, just as it is a good idea to have 'forget me everywhere' functionality. A user's account should be associated with a single user. If this user wants to sign in on multiple devices, they should be able to do so. Just the same, they should be able log themselves out ...


2

It highly depends on your authentication strength : if you're using a two factor one - it's safe enough. Otherwise if it's as weak as 1-factor - you're pointed a Con that rids out all of the benefits of this ability


0

Yes, this could give rise to a session fixation vulnerability. Say your site is on example.com and you allow users to upload their own pages to usercontent.example.com to guard against Cross-Site Scripting. You may think that cookies on example.com are safe from any script running on usercontent.example.com because the host-only-flag is set by default on ...


1

In ASP.NET it is normal to reuse a session id. As for the data stored in the session, if you want to make sure that the data cannot be accessed once the user logs out, you can call Session.Abandon() in your logout functionality. But even if you don't call Abandon, the session is no more vulnerable than it is while the user is logged in. Abandoning simply ...


0

We should make one thing clear before we move one: Depending on the setup: Session IDs are not the same as session data This doesn't mean it's safe, but it also doesn't mean it's unsafe. Now let's work through the state machine of user sessions throughout the entire transaction and see what happens with the data in the session: Session begins Computer ...


0

" When a server supporting the Token Binding protocol receives a bound token, the server compares the TLS Token Binding ID in the security token with the TLS Token Binding ID established with the client. If the bound token came from a TLS connection without a Token Binding, or if the IDs don't match, the token is discarded." draft The problem ...



Top 50 recent answers are included