New answers tagged session-management
The attacker never logs into the site with their credentials, they just access a page to get the session id, so while they pass on a valid session id to the victim, they do not pass on an authenticated session. When the victim logs into the site, the session is now authenticated and the attacker can access it as the victim.
The easiest way to invalidate all in memory sessions is simply to restart your application server(s), which will clear the in memory session cache and make everyone's session cookies invalid. Also, if you are using a login framework that supports persistent logins (you are if you have a 'remember me' checkbox on your login form), then you can and should ...
This feels more like a point of discussion, rather than a question. This is because there is no definitive answer to your question, merely conjecture. The best method for answering your question is to conduct a risk assessment. This will encompass your risk appetite and thus give a better indication as to which method is best suited to gathering and storing ...
Top 50 recent answers are included