Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
My College Router has Dell Sonicwall authentication. We will be automatically redirected to the login page. If the username and password is correct a new popup opens showing that user 'x' has logged in and you have 'y' minutes remaining. We are asked not to close this tab when using internet. If we close this tab, we will have to login again.My question is how does it know that we haven't closed the tab(Why should they use such a technique?).
The new tab is named 'login status top'.
It does work by either having a meta refresh, or a JavaScript, that continually send request to hold your session alive.
Basically, it works by having a session identifier, that is a random string. This session identifier might be valid for lets say 3 minutes. Each minute, that webpage will either execute JavaScript code, or do a meta refresh, causing the page to get a new session identifier that is valid for Another 3 minutes.
The reason it knows you have closed the window, is that the session will no longer be renewed, thus your session will expire.
The reason of using such a system, is to prevent people from spoofing MAC-adresses and IP-adresses to "steal" a other's login session.
The popup is often delivered over HTTPS, so once the original user stops using the session, theres no way for the attacker to keep the session alive.
In some cases, a interlock scheme is used instead of HTTPS (or sometimes in combination), which consist of a JavaScript which is constructed to do some Exchange of secrets with the server each session renew, in a way so it requires a MITM attack to subdue the system.
