0

I am new to web application security and have a few doubts regarding session cookies.

Which of these is considered more vulnerable:

  1. Having the same session cookies for a user logging in from different machine/browser

or

  1. Having different session cookies for a user logging in from different machine/browser

If it's possible could you provide a quick scenario of how each can be exploited?

Thank you.

1
  • Do you mean tying a static session to a user in question one? Don't do that. Session identifiers are meant to be virtually impossible to guess so should be unique regardless of the user who is logging in. – Pedro Jun 4 '20 at 22:33
1

Having the session cookie specific to the machine or browser offers at least the possibility to associate machine/browser specific information with the cookie (like some kind of browser fingerprint). Such associated information might then be used to better detect if the cookie was used on a different machine, i.e. impersonation done via cookie theft.

Note that this cookie protection is purely optional, i.e. just because the cookie is machine/browser specific does not mean that such information will be definitely associated with the cookie but only that this could be done.

If the session cookie is instead machine/browser independent such protection is not possible at all, but instead a stolen cookie could easily be used from other systems. This means the risk of impersonation would be higher.

Which is more vulnerable ...

None of this actually presents a vulnerability. A vulnerability would be if some attacker could steal the session cookie, for example using XSS or by sniffing unprotected connections. The options you present only offer more or less ways to mitigate the impact of the vulnerability by making it harder or easier for the attacker to misuse the stolen cookie.

1
  • Thank you Steffen, that explanation really helped. – vish Jun 4 '20 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.