Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

Explanation for maldetect advice

I received a notice from maldetect on an Apache machine I'm running, and I've not seen an advice like this before. I'd like to get a better understanding of exactly what I am looking at. I received ...
0
votes
0answers
49 views

What is the term for data leaking from one HTTP request to another and how to prevent it?

Context We recently added a feature that used a library whose API we misunderstood. Long story short, if user A sends a request to our web application, the library caches some result, and that result ...
0
votes
0answers
39 views

What if session cookie is stolen? Doesn't it have a similar effect with getting access token stolen

Most security specialist teams, OWASP, Auth0, Okta to name some, agree on that keeping access token in browser should be avoided. And one of the alternatives to this approach is having a proxy server ...
0
votes
0answers
55 views

Simplest secure way to create session cookies

Background: I've been using a simple session cookie design for my web app. I have a users table, and a sessions table that basically looks like this: id | user_id | visited_at -----+---------+-------...
0
votes
2answers
54 views

Is it safe to store session state of different apps in single Redis cluster?

We have "web app as a service" offering. And right now each app has its Redis which stores session data. Is it secure if we use one redis cluster for all clients using this app. To be clear ...
-1
votes
0answers
54 views

Cookie expiration time : Is it really necessary? [duplicate]

Why not cookies be just there forever? Why expiry time is needed? Unless the app is very security critical (like banking) I don't find a reason to expire the session. Why irritate user frequently with ...
3
votes
0answers
80 views

Should you terminate a session when an incorrect CSRF token is submitted?

According to the OWASP CSRF Prevention Guide if the server fails to ...verify the existence and validity of the token in the request compared to the token found in the user session ... then the ...
3
votes
4answers
176 views

Passing plain text password over HTTPS

My login for POST is over HTTPS. Therefore, I don't do anything to the provided password before submitting. And I don't see an issue there unless someone is watching your browser's developer console. (...
-1
votes
2answers
306 views

This client doesn't verify which representation it requested, while expecting a specific one. What are the security implications? [closed]

I am currently investigating a mobile app API. There is a feature which fills in a form in the app automatically. The user supplies a string which contains all the compressed form data. And then the ...
0
votes
1answer
43 views

Are encrypted cookies over http safe? [duplicate]

I am new to cookies. My understanding of encrypted cookies is that a server can store info. at client side without the client knowing about its contents. Now, let us say a server generates ...
1
vote
1answer
56 views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
0
votes
1answer
36 views

Same session cookies for a user logging from different browser/machine

I am new to web application security and have a few doubts regarding session cookies. Which of these is considered more vulnerable: Having the same session cookies for a user logging in from ...
2
votes
2answers
94 views

What attacks are httpOnly cookies intended to prevent?

I know that HttpOnly attribute restricts the cookie from being accessed by JavaScript etc. Is there any specific attacks regarding this issue? Can cookie theft and hijacking be counted as attacks ...
1
vote
1answer
46 views

What are the security risks of storing user roles/types in a cookie?

Recently I had to use a website which stored things like user role (user or admin) in a cookie. When I modified the username the displayed username changed in the website. I immediately asked the ...
1
vote
0answers
78 views

Are JWT still not recommended for sessions?

It seems there is a large divide as to wether or not you should have JWT or Session ID for managing user session on WebApp/API (for a web front end or/and a mobile app). It seems that the consensus ...
0
votes
2answers
39 views

is it safe to implement custom way of storing cookie in android?

i want to store session information in android application temporarily (as long as application is running). i am sending real-time data to node.js server from android client using Custom Protocol (...
10
votes
3answers
246 views

Risks of Long-life Session

Most "big" websites seem to have enormous sessions. From looking through the cookies, Stack Exchange seems to have a one-week rolling session, GitHub has 45 days, and Gmail seems to have a never-...
2
votes
2answers
78 views

Should a SAML Assertion whose SessionNotOnOrAfter value is exactly the same value as its AuthnInstant be treated as having an invalid session?

I am receiving SOAP requests with SAML AuthnStatements whose SessionNotOnOrAfter timestamp is EXACTLY the same value as its AuthnInstant: <saml:AuthnStatement AuthnInstant="2020-04-22T21:11:41....
1
vote
1answer
44 views

Supporting deep links in a web application without permitting session theft

I have a question about "session-theft" and the supporting of "deep links" in a web application, and best practice. Our web application has a small number of front-door public web pages (e.g. /...
2
votes
4answers
142 views

How to securely set a cookie on another subdomain?

I have a microservice app. hub.example.com handles authentication. When a users logs in, I need to set a cookie on learn.example.com What is a secure way to set this? I'm aware of a few approaches: ...
0
votes
0answers
37 views

TLS Session ID from Client's First Visit

Why would a client send a TLS session ID (96b839ce3aadb65780923d28a3e7e767fc5bddc507884a7e70e506d8b85a06d3 on its first visit to a server/website? My understanding is that the client would include a ...
0
votes
0answers
26 views

Replay-Resistant Stateful Session Handling

I am currently creating an RPC server using gRPC and want a secure way to handle session tokens. I am currently using stateful session handling, where the user logs on and the server replies with an ...
0
votes
1answer
66 views

Using a persistent httpOnly cookie for authentication? (SPA)

So I'm building an application that needs authentication, I'm wondering if there's an security concerns with using a persistent httpOnly cookie to store user authentication with a SPA? (only 1 server. ...
0
votes
2answers
59 views

Is it safe to save a user's email into php session variable for later use?

I'm in the process of creating a password reset functionality for my project. I currently have my website send a password reset link to the user's email if they request it and validates the link ...
1
vote
1answer
74 views

Is it a security risk to strore item IDs in sessionStorage?

I've been working on an eCommerce store for people to be able to buy items. I want to implement a basket system for this store. Looking at lots of other posts, it is clear to me that there are ...
1
vote
1answer
59 views

How to ensure JWT security in authentication?

I have implemented a backend as a REST API. To maintain the statelessness in REST, I intend to use JWT to verify that that a user has logged in or not. (A user is logged in if a valid token is present ...
0
votes
0answers
28 views

how this default Session ID can be malicious or cause unintended results in application

I was looking the docs on what damages can be done by hackers if default Session ID is revealed in web application.
2
votes
1answer
92 views

Double JWT submit method

I'm implementing my JWT method by using the double submit method: where we separate the payload & header portion of the JWT from the signature. The header & payload is stored in a separate ...
26
votes
5answers
7k views

Should concurrent logins be allowed?

We have a web app (Django) that logs users out if they haven't made a request within 1 hour. From a security point of view, is it good practice to also block concurrent log ins? In other words, if a ...
1
vote
2answers
931 views

If I am using a VPN with allowed multiple connections can each user/device be able to view traffic of the other user?

If I am using one a VPN Service, but it allows up to lets say 8 devices to connect, are all the devices/users able to view traffic from other users/devices? Or is each VPN connection creating its own ...
0
votes
3answers
94 views

Sending static registration links via email

In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
1
vote
1answer
42 views

Session sync between two web apps on the same domain

I have a Laravel 6 site, and a legacy Drupal 7 site. Both are served under the same domain, and both share the same user database table. I'd like users to be able to log in via Laravel (never via ...
3
votes
1answer
561 views

Is session/cookie based authentication stateful or stateless?

Flask Web Development says The current login functionality implemented with the help of Flask-Login stores data in the user session, which Flask stores by default in a client-side cookie, so the ...
1
vote
2answers
74 views

Should I avoid authenticating the user unnecessarily to a server?

I’m thinking a RESTful client–server architecture. There will be routes that require users to authenticate before they can access the resource (e.g. creating or editing resources). Other resources are ...
0
votes
0answers
60 views

Firebase token storage on logout

We are looking to implement push notifications for things like when a user receives an internal message within our app. We have an application with sensitive data so we have a short length inactivity ...
0
votes
1answer
65 views

Sending httpOnly cookie also in HTTP response body

I've done some researches on this topic, and I found this question on SE: Sending session cookie inside the HTTP response body But this answered my question just in part. On login, my server will ...
0
votes
0answers
24 views

Viability Session ID Spoofing

On my application, all users, are assigned an ASP.NET_SessionId. This session id is 24 characters, alphanumeric, and all lowercase. Since all users, whether authenticated or not, are assigned a ...
3
votes
1answer
232 views

What attacks are prevented using Session Timeout or Expiry?

OWASP recommends setting session timeouts to minimal value possible, to minimize the time an attacker has to hijack the session: Session timeout define action window time for a user thus this window ...
3
votes
2answers
118 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
2
votes
1answer
961 views

Session id in custom header

Is there a way to perform session fixation attack with XSS present if session id is passed in request header? As far as I see it, theoretically there are three ways to do so: intercept request on ...
2
votes
1answer
76 views

Should I hash session IDs before storing the session contents?

I am wondering if it is smart to hash my session IDs before writing sessions to the session storage, in order to prevent session ID disclosure. I am writing an application in PHP on top of the ...
0
votes
1answer
74 views

Security Considerations To Account for When Redirecting From Microservice to Another

I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
0
votes
0answers
43 views

Session hijacking: JSESSIONID resets on being changed to another valid one

I am trying to understand session hijacking, and read that to avoid session fixation, the id should be regenerated on authentication completion, and so I have implemented in my application. Playing ...
1
vote
2answers
92 views

Session ID containing username?

Is it safe to append the user's username to the session ID? The session ID is 32 bytes long generated using a secure PRNG. I encode it using base64 URL to save it in a HttpOnly cookie. The cookie ...
1
vote
2answers
222 views

Hashing Session ID

For my app I use redis as a session store. Is it safe to store the session id without using a hash function? If I should use a hash function, the client would receive the cookie with the raw or the ...
0
votes
2answers
112 views

Baking a better cookie - How can we prevent a high-jacking of the user's local cookie file to exploit accepted cookie use?

This question is similar to Hashing cookie-values & preventing cookie-stealing however, it is significantly different as I am interested in preventing (internal) subscription fraud, rather than an ...
0
votes
0answers
43 views

Why use a refresh token for authentication?

I recently stumbled upon this article which recommends using two tokens for authentication. Once the user is logged-in (or registered), the client receives an access token and a refresh token, ...
0
votes
1answer
723 views

Backend Authentication of Mobile App: Session ID vs. OAuth

Currently I am developing an iOS/Android app and a corresponding backend in PHP. In the last days I read a lot about user authentication and now I am a bit confused. For now I am using a session ID ...
1
vote
0answers
128 views

Best way to let 2 servers communicate (with PHP) avoiding IP Spoofing?

Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP ...
0
votes
0answers
43 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...

1
2 3 4 5
10