How often to companies develop their own session management process?

Question

I have been starting to read "The Application Hackers Handbook 2nd Edition" and just recently finished reading "Chapter 7: Attacking Session Management".

Do companies develop their own session management library or do they use well-known developed libraries (ex: Passport.js and etc.)? The book mentioned a lot regarding identifying and guessing the generated session from the server, is this worth the time to do during a pentest? Is there a rough estimate on how many percent of companies do develop and use their own session management?

I am guessing that big companies like Google, Facebook, and others do use their own libraries, what about the mid-sized companies?

Answer 1

This depends on the architecture of your application, but judging from the examples provided I assume you are referring to web-services served through user agents such as browsers or native apps. The issue with server-managed sessions is that they go against the idea of statelessness.

"Google, Facebook, and others" usually handle sessions through persistent cookies which possess information to re-authenticate against an identity provider serving as the respective organization's own authorization server. The identity provider then again issues access tokens on behalf of the user to gain access to a resource (see OAuth and OIDC). This way the server is generally agnostic towards the concept of sessions. I can't give you any precise numbers, but smaller companies not rarely rely on certain charged providers to set up an identity provider on their behalf. Since this is a non-trivial task companies who lack the resources not rarely rely on persistent cookies to authenticate directly against the resource server. Virtually any major framework possesses the tools to build such an architecture.

Do not let your security rely purely on a high-entropy session id.

Keep in mind that the user agent possesses a lot of attack surface to nick all sorts of stored information. Encrypted HttpOnly-cookies served only over HTTPS should be the bare minimum.

Answer 2

Most backend frameworks have a well working implementation for session IDs. I think you should check the session nevertheless. There is always a change for bugs or implementation errors even in those libraries. Also there is the chance for own implementations of the session management as you mentioned.

But you don't have to try to break a session id, if it is very long and random even after some logouts and logins. But if it's only a number and increasing with every login, a date or timestamp or it is quite short, then you should try to guess the sessions.

So to summarize it: Look after the session ids but then decide, how much time you want to spend on it.