0

I am working on a project where users can post. When a user logs in and the password is correct, it logs them in and checks the database. If they have a session id, it returns it, if not, it creates a new session id and returns it. If they log in again somewhere else such as their phone it does the same; if a session id exsits it returns the session.

My question is, is this secure? Should each device they log in with have a seperate session id? The only time I delete the session id is when the password is changed.

|improve this question
2

TL;DR: No, not secure.

Having a separate ID for each device is important, because if you give them the same one, there is nothing stopping the device from remembering it after the user logs out.

More importantly, only changing the session ID when the users changes password is catastrophically bad. The ID can be stolen much more easily than a password. Sessions should have expiration, otherwise special consideration have to be made, for example allowing users to sign out from devices they no longer have access to.

PS: I also assume your session ids are random. If they are sequential, you also need some sort of token/secret to authenticate, otherwise an attacker may just go through all ids and grab data. Note that using random IDs may be preferable, as attackers still may get some information, like number of registered users, if the IDs are not random. You can use secret in addition to random ID as well, can't hurt and may help, so why not?

|improve this answer
  • The id's are random. Also the problem is it is also supported in an app which users don't want to expire every month or so and require them to login again. What if a user logs in through web and clears cookies or uninstalls the app therefore the session is not deleted resulting it a database full of unused ids – Dan Apr 25 '18 at 1:07
  • 1
    @Dan Then you have a database full of unused ids. Not really a big deal as long as you have some way of automatically clearing them out after expiry. – AndrolGenhald Apr 25 '18 at 1:12
  • @Dan I think the best way would be to issue a token to native apps, which could be used to authenticate for new sessions. So standard sessions would still expire, but the apps would silently log in using this token again and get new session. You should most definitely allow revocation of these tokens and an overview of how many devices are authorized (how many tokens are not revoked/deleted form the DB). – Peter Harmann Apr 25 '18 at 1:13
  • Also, in order to prevent spam in your database, you may allow only let's say 10-20 sessions per user and delete the oldest once this limit is reached. – Peter Harmann Apr 25 '18 at 1:14
  • 1
    @Dan yes. And just to underline the importance, have a way to revoke the token by the user. Ideally with a description of what kind of device it is, like "Android Phone" – Peter Harmann Apr 25 '18 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.