We’re rewarding the question askers & reputations are being recalculated! Read more.
2 grammar
source | link

A site using session tokens is not a vunerability as long as the tokens are long enough that they can never be realistically brute-forced or guessed. This means that the entropy should be at least around 64 bits, but preferably more.

Why is this not a vunerability? It can't be exploited. You can steal the session cookie if you have access to their PC, but you can also just steal their password or login from their PC. The session cookie doens't add any vulnerability.

 

There were also xss vulnerabilities that could allow me to get session token of the victim

Now, that is a vunerabilty.

 

i want to understand a web application that gives access to anyone with valid session token no matter if they are on different devices with same token

That's also not a bug or vunerability, but a feature. What if a user updates their browser during a session? Their user-agent would change, but you wound'twouldn't want them to have to login again. You also should't bind sessions to IP-addresses as users can change IP at random, especially when not at home.

A site using session tokens is not a vunerability as long as the tokens are long enough that they can never be realistically brute-forced or guessed. This means that the entropy should be at least around 64 bits, but preferably more.

Why is this not a vunerability? It can't be exploited. You can steal the session cookie if you have access to their PC, but you can also just steal their password or login from their PC. The session cookie doens't add any vulnerability.

 

There were also xss vulnerabilities that could allow me to get session token of the victim

Now, that is a vunerabilty.

 

i want to understand a web application that gives access to anyone with valid session token no matter if they are on different devices with same token

That's also not a bug or vunerability, but a feature. What if a user updates their browser during a session? Their user-agent would change, but you wound't want them to have to login again. You also should't bind sessions to IP-addresses as users can change IP at random, especially when not at home.

A site using session tokens is not a vunerability as long as the tokens are long enough that they can never be realistically brute-forced or guessed. This means that the entropy should be at least around 64 bits, but preferably more.

Why is this not a vunerability? It can't be exploited. You can steal the session cookie if you have access to their PC, but you can also just steal their password or login from their PC. The session cookie doens't add any vulnerability.

 

There were also xss vulnerabilities that could allow me to get session token of the victim

Now, that is a vunerabilty.

 

i want to understand a web application that gives access to anyone with valid session token no matter if they are on different devices with same token

That's also not a bug or vunerability, but a feature. What if a user updates their browser during a session? Their user-agent would change, but you wouldn't want them to have to login again. You also should't bind sessions to IP-addresses as users can change IP at random, especially when not at home.

1
source | link

A site using session tokens is not a vunerability as long as the tokens are long enough that they can never be realistically brute-forced or guessed. This means that the entropy should be at least around 64 bits, but preferably more.

Why is this not a vunerability? It can't be exploited. You can steal the session cookie if you have access to their PC, but you can also just steal their password or login from their PC. The session cookie doens't add any vulnerability.

 

There were also xss vulnerabilities that could allow me to get session token of the victim

Now, that is a vunerabilty.

 

i want to understand a web application that gives access to anyone with valid session token no matter if they are on different devices with same token

That's also not a bug or vunerability, but a feature. What if a user updates their browser during a session? Their user-agent would change, but you wound't want them to have to login again. You also should't bind sessions to IP-addresses as users can change IP at random, especially when not at home.