Tag Info

New answers tagged

2

The WebSocket TLS (WSS) connection is a different connection from the HTTP TLS connection. A WebSocket connection is created sending a HTTP request containing the wish to upgrade the connection to WebSocket and by receiving a HTTP response granting this wish. From then on the WebSocket protocol is spoken inside the upgraded HTTP connection. This means ...


1

I believe your premise is flawed. Alice doesn't log on to bob.com via normal HTTPS means, because Alice sees the invalid certificate error and smartly decides not to enter in her credentials. If Alice chooses to ignore the warning and proceed anyway, then now she has the same problem that she would have on any financial or high security site too. Her ...


2

What the client actually stores is the set of security parameters, the most important part of which being the master secret: this is the secret value shared with the server, obtained from a previous handshake. The session ID or session ticket is just a value used to reference that master secret(*). The master secret is very sensitive (knowing it allows ...


1

This is actually not that uncommon a setup. Typically where an application uses stateless cookies, there's no way apart from timeout to invalidate the session. The advantage of this appraoch is that the server doesn't need to maintain a list of valid cookies, which is handy for scaling, the downside is (as you've noticed) if the application has a long ...


1

It knows it's you because you're sending all requests over the same stream (TCP) connection. (And TCP knows that because the ports and packet sequence numbers all match.) In other words, LDAP is a stateful protocol, and the whole session (including authentication) is implicitly bound to the underlying connection. (The same as with all other similar ...


2

A more complete answer from http://hueniverse.com/2015/07/08/on-securing-web-session-ids/ Disclaimer: like any security advice from someone who doesn't know the specifics of your own system, this is for educational purposes only. Security is a complex and very specific area and if you are concerned about the security of your system you should hire an expert ...



Top 50 recent answers are included