2

Should the Session ID generated after logging in be marked invalid when the user closes the browser without logging out?

Could this be a security flaw? If yes,is it possible to exploit this?

7
  • let me frame my question again for more clarity, should the session id generated after logging in be made invalid when the user closes the browser without logging out?
    – Vinod Pn
    Jul 27, 2016 at 15:00
  • 1
    How will you detect when the browser closes? Jul 27, 2016 at 16:25
  • Cant we have a js which continuously sends some data to the server and server can keep track of that to know whether browser is alive or not? And also to confirm , server can try to connect to the browser's port .. if the connection succeeds well and good or else we can destroy that session id.. There could be better solutions too..
    – Vinod Pn
    Jul 27, 2016 at 17:47
  • 1
    Server can't connect to the browser's port since there is no listening port in the browser. The connection is one way from browser to the web server.
    – void_in
    Jul 27, 2016 at 18:43
  • 1
    Keep the session timeout short and upon a period of non user activity (say 10 minutes), expire the session.
    – void_in
    Jul 28, 2016 at 5:16

2 Answers 2

2

Browsers do not normally listen to any port so there are no port to send the SYN-ACK to. The browser is also often behind a NAT so you cannot even reach any port on the computer the browser is running on except when answering requests. Having an open AJAX request or using web-sockets is of course possible but will be costly in server requirements.

Browsers deletes the session cookies when the browser is closed, if you close it normally and not only kills the process, so the session is permanently lost on the client side when the browser is closed.

The normal option is to set a relatively short session time for your server to close the session when there are no activity on the client. You could also set this really short if javascript is enabled and send a keep-alive request to keep the session open as long as the site is open in the browser.

There are some other means you could use to secure stale sessions, the most simple is to have an onBeforeUnload listener to send a logout request when the visitor leaves your site, this do of course also require that javascript is enabled in the browser. One other thing you could do is to keep track of IP and fingerprint from the browser and connect it to the session so you can test if the browser having the sessionId do not change.

If you have a site with high enough security requirements for you to have to worry about this you should be more concerned about what happen when the user navigate away from the site or close the tab and leaves the browser open

1
  • onBeforeUnload listener is what i was looking for, thank you
    – Vinod Pn
    Jul 28, 2016 at 8:42
3

Yes, keeping the session valid after the user closes their browser is a minor risk. You want to keep the time that a session token is valid to the minimum. After the user closes the browser he certainly is not going to use it anymore, so there is no sense in keeping it valid.

The problem is you don't get notified when a user closes his browser. An alternative is to detect whether the user still uses your application. Your application can look at the time between requests, and if there has not been a request in 10 or 20 minutes, the user can be assumed to have ended the session and the session token can be invalidated.

However, this means that the user gets logged out when he has your application open but doesn't make requests. To solve this, your application can send requests itself when it is being used. With Javascript the client can send a request every minute or so letting the server know the application is still in use. This way the session stays valid as long as the web application is opened in the browser.

1
  • i wish i had enough reputations to upvote :)
    – Vinod Pn
    Jul 28, 2016 at 8:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .