0

My College Router has Dell Sonicwall authentication. We will be automatically redirected to the login page. If the username and password is correct a new popup opens showing that user 'x' has logged in and you have 'y' minutes remaining. We are asked not to close this tab when using internet. If we close this tab, we will have to login again.My question is how does it know that we haven't closed the tab(Why should they use such a technique?).

The new tab is named 'login status top'.

1
  • The device sounds like it's using the tab to keep a session open, and authenticating requests through that session (which would end as soon as the tab is closed) - it would be interesting to see if the tab closes itself at that time or not. Oct 16, 2014 at 16:37

1 Answer 1

1

It does work by either having a meta refresh, or a JavaScript, that continually send request to hold your session alive.

Basically, it works by having a session identifier, that is a random string. This session identifier might be valid for lets say 3 minutes. Each minute, that webpage will either execute JavaScript code, or do a meta refresh, causing the page to get a new session identifier that is valid for Another 3 minutes.

The reason it knows you have closed the window, is that the session will no longer be renewed, thus your session will expire.

The reason of using such a system, is to prevent people from spoofing MAC-adresses and IP-adresses to "steal" a other's login session.

The popup is often delivered over HTTPS, so once the original user stops using the session, theres no way for the attacker to keep the session alive.

In some cases, a interlock scheme is used instead of HTTPS (or sometimes in combination), which consist of a JavaScript which is constructed to do some Exchange of secrets with the server each session renew, in a way so it requires a MITM attack to subdue the system.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .