Tag Info

New answers tagged

3

You could leverage local storage, but then you also risk exposing it a multi-user or public computer, or usability fail if the user uses multiple computers. In your email solution, you could add a special code/token/password in addition to your identifier. So you have the identifier (UUID) and then a secret. You do still have an exposure if the email is ...


1

Whether it's bad for security depends on whether the information they're entering could be considered "sensitive". Would it matter to the applicant if someone else could guess (however unlikely) their session id and get access to whatever data they've already entered? (Is confidentiality of the data important?) Would it matter to the organization who is ...


4

The attacker never logs into the site with their credentials, they just access a page to get the session id, so while they pass on a valid session id to the victim, they do not pass on an authenticated session. When the victim logs into the site, the session is now authenticated and the attacker can access it as the victim.


4

The easiest way to invalidate all in memory sessions is simply to restart your application server(s), which will clear the in memory session cache and make everyone's session cookies invalid. Also, if you are using a login framework that supports persistent logins (you are if you have a 'remember me' checkbox on your login form), then you can and should ...



Top 50 recent answers are included