Questions tagged [session-management]
Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user
0
votes
0answers
4 views
Session Management to avoid session fixation [migrated]
How do I maintain the same session state with different session ID as we get a login request? Do I need to do anything else from the server end other than just assigning the session id in Response....
1
vote
2answers
55 views
How to implement secure user sessions using HttpOnly cookies?
I'm creating a web application, and want to allow users to log in (and stay logged in). My plan to support this in a secure way goes as follows:
User logs in from a login form - when successful, the ...
1
vote
2answers
46 views
Effects of new random Session token for each HTTP Request
On successful authentcation, a web application issues a session cookie that is a constant length string of apparently random hex characters.
...
1
vote
1answer
23 views
restoring logged out gmail session in running instance of chromium browser?
My situation is:
+I have created a special purpose gmail account
+I used a complicated password to protect the account. On purpose, I did not use any 2FA options are a "reset" email address or phone ...
1
vote
0answers
31 views
Rotating session names vs a static session name with a rotating validation string
I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
0
votes
0answers
15 views
Generate new session on auth: before or after 2FA?
I'm following the owasp cheat sheet to handle sessions in my web app: https://www.owasp.org/index.php/Session_Management_Cheat_Sheet
It is recommended to always generate a new session on any ...
0
votes
1answer
54 views
Harden against privilege escalation in Microservices
Please consider the following scenario.
The system has a set of business owners (i.e. users of the system)
Each business owner is mapped to a set of customers
The business owners login to the system ...
0
votes
2answers
225 views
JWT or session cookie for API for both web and mobile app?
I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach.
The only two requirement are:
I need to know the users that are ...
0
votes
1answer
45 views
Handling race condition at the time of renewing the session
I've recently asked this question on SO. As the question was not answered yet, I've come up with an approach. But I wanted to check if there is not any security flaw in this solution.
Question
I had ...
0
votes
2answers
85 views
why MAC address can not be used as session identifier instead of session ID? [duplicate]
why MAC address can not be used as session identifier instead of session ID?
why the physical address (MAC address) cannot be used as a session identifier during the communications between servers ...
0
votes
1answer
95 views
A different CSRF token and session ID passed in the request [closed]
A CSRF token is what a server includes in its response, that is the same token which is passed in the request from the user.
In my case, a different CSRF token is getting included in the request- ...
1
vote
0answers
42 views
Generating session with id and password
Most web apps generate a long hex number and use it as a sessionid.
My idea is to create an ID which is auto-incrementing for each generated session and assign it a random secure string (a password). ...
0
votes
0answers
87 views
Can PASETO replace JWT for API authorization?
Has server symmetric-keyed PASETO been seriously evaluated as a viable candidate to replace JWT for API session authorization?
JWT
https://tools.ietf.org/html/rfc7519
https://jwt.io
PASETO
https:/...
0
votes
1answer
201 views
Should client have access to 3rd party API access token?
I'm trying to determine whether to use a Token provided by a Third Party service directly, OR issue my own custom Token and store the Third Party Token server side.
Authentication flow
User ...
1
vote
1answer
49 views
Should you remove the user's application PIN if they explicitly log out
I am looking for some security driven insight on when to dispose of a mobile application user's PIN in a few scenarios:
Background: When the user downloads and installs the mobile app, they are asked ...
0
votes
0answers
99 views
Multiple sshd sessions for single SSH login
I was grepping through /var/log/auth.log and noticed that for some reason, not every time, but sometimes when I would log in via SSH I would see entries like the following - where there were multiple ...
4
votes
2answers
248 views
Why we store session id instead of user id inside cookies?
Would not it be better to store user id instead of session id so that we only lookup database once for extracting other user info instead of twice extracting user id from session db then user db?
0
votes
1answer
99 views
How to implement machine tagging when allowing a user to “remember me” on web application? [duplicate]
The remember me cookie should identify the machine as well. So by implementing machine tagging, we will avoid a situation when an attacker tries to login with the user cookie from another machine. ...
0
votes
1answer
28 views
Best strategy to share some sensitive user data between Node and PHP
I am creating a website that is built on PHP. It has a small page where users can have a group chat and message each other. For that page I open a websocket with a help of socket.io and expressjs. I ...
1
vote
1answer
28 views
Security implications of using long lasting authentication cookies
I'm trying to find some information about potential security risks with allowing long lasting cookies for website authentication.
Initially it was set to not persist the login session, so it would ...
0
votes
2answers
66 views
How many characters should a session key be?
I have a session key generator that uses only letters and number. I've looked up how long a session key should be here:
https://www.owasp.org/index.php/Insufficient_Session-ID_Length
and by some ...
0
votes
2answers
58 views
Are contents of PHP sessions forensically valuable?
PHP has some nice, neat builtins for dealing with sessions: there'ssession_start() and session_id() and session_destroy() functions, which work with a superglobal variable, $_SESSION, to store name/...
1
vote
0answers
181 views
Should I hash my refresh tokens before storing them in the server's database? [duplicate]
I have a service with a client app (Mac).
To log in, users enter their username and password in the client app, which sends this information to the server.
The server verifies this information using ...
1
vote
0answers
150 views
SAML 2 | Refresh IdP Session when user is working on SP
Wanted to discuss the solution and options to refresh the IdP Session when user is actively working on the SP.
The use case is that after successful SP-Initiated SSO, there are two sessions in ...
-3
votes
2answers
219 views
Where will cookie be created. Client side ? Server side ? How it will be validated
I wanted to know where exactly a cookie be generated ie., client side / server side.Because if I intercept the request before logging into the application, Header with cookie will be displayed . So, ...
1
vote
0answers
31 views
logout all devices or only one
I wonder which is the best practice in terms of security. Assuming an application where one can login from multiple devices in parallel what I should expect from "logout" button? To logout the user ...
2
votes
2answers
271 views
Use javascript variable instead of session cookie
I have decided to plunge deep into Angular-like technologies, where all pages are practically just one page that gets never reloaded. And at this point I had the idea, instead of using cookies (which ...
2
votes
1answer
177 views
Does user-agent session tracking provide any benefit?
On a phpBB forum I manage a user has requested that we turn off the "Validate browser" setting which invalidates user sessions if they change user-agent, because they use a mod which randomises their ...
4
votes
4answers
479 views
How dangerous is storing the hashed password in local storage?
I'm looking at a web application that does something I find very unusual in the handling of login sessions.
The application hashes the password with SHA256 and salt and saves it either in session ...
0
votes
0answers
14 views
TLS Session resumption for non-existing sessions [duplicate]
I have tested this multiple times: I use a fresh PC, with newly created test user (on Mac and Windows), open Incognitto Chrome and enter THE specific website address; then I see "Client Hello"s with "...
2
votes
1answer
101 views
Protecting the user from unauthorized access
So we are planning on adding a feature to our app that is similar to what Google does, but a little stricter:
You have a list of sessions that are tied to a user agent and IP address(?) (google shows ...
1
vote
0answers
47 views
What are the security benefits of creating a session vs. just using Google ID token every time in my server back end?
I'm using Google Sign In to authenticate my users with my server back end via my Android app.
So far I am able to sign in and obtain an ID token, which I then send to my server back end for ...
1
vote
1answer
33 views
What is this scheme called and how should it work exactly?
So I was thinking about client-server communication and how to keep this private, especially from man-in-the-middle attacks. I came up with a scheme that I'm sure exists already, but I could not find ...
1
vote
2answers
92 views
Why are third party cookies sent to second party websites?
When I visit this website, Google Analytics cookies are being sent to it from my browser along with the request.
This goes against my whole understanding of cookies which is that cookies are only ...
0
votes
1answer
45 views
Work with user tokens and sessions [closed]
I am trying to develop a social media app and website. The problem is I am trying to find a secure way to work with logins and sessions since other methods don't seem good or have better ways.
For ...
2
votes
3answers
177 views
Why shouldn't my client just send the user's username and password with every request?
I have a PHP server and an Android/iOS client, and SSL is used for all communication.
The PHP server is a JSON API with 2 public functions (register, login) and many private functions (which require ...
-1
votes
1answer
26 views
Access Token or User Id
After logged in to application, why one should use "access token" instead of simply using "user name", to call further APIs ? How it is more secured with access token ?
0
votes
1answer
85 views
Can I use a single permanent session ID for all of a users devices?
I am working on a project where users can post. When a user logs in and the password is correct, it logs them in and checks the database. If they have a session id, it returns it, if not, it creates a ...
2
votes
1answer
270 views
Should I let the client send both the session and the user ID?
I am working on a project where users have accounts and log in using their username and password if they are correct the code returns a session id. Next time they open the app or visit the site it ...
7
votes
1answer
526 views
Security implications of not reusing SSL session in FTPS
I've just run into a problem with our FTPS server refusing connections due to missing SSL session reuse. Our client actually should reuse them, but it just doesn't work. I'm well aware that it's not ...
0
votes
0answers
421 views
Why do some mobile apps keep me logged in and other apps log me out?
I have some mobile banking apps on my iPhone - and I have to login everytime I want to use the app. I also have another app from a different financial institution that keeps me logged in. I only had ...
20
votes
2answers
2k views
Is there any point in setting the secure cookie flag for HSTS websites?
If my website has HSTS and forced HTTPS (i.e. user won't be able to access the plain HTTP version of the website), is there any point in setting secure: true for the cookies?
0
votes
0answers
26 views
Invalidate session after browser closure [duplicate]
In my application when I close browser window cookies are deleted by a browser, but session is not invalidated.
Is it a standard and recommended option to capture a closure event and invalidate ...
0
votes
1answer
335 views
How to get session info out of encrypted .NET viewstate?
I am performing a penetration testing for the first time in a .NET application that instead of providing cookies for session management uses the viewstate hidden field.
I am using the .NET Beautifier ...
1
vote
1answer
617 views
Store splitted JWT for CSRF protection and refresh strategy
I've been reading a lot about stateless authentication systems, and I want to implement something with JWT for the first time, but now I'm concerned about how to properly (and securely) consume a ...
3
votes
2answers
61 views
Store basic oAuth for a session on a website
I am not sure if there is a good way to do this. Currently I have a website that users log into. In that website there is pages that have API calls to another service, this service uses:
...
3
votes
1answer
132 views
Clarification on how session fixation attacks works
Starting with OWASP I am learning how session fixation attacks work.
This is the scenario: The attacker has the session ID generated by the server (by logging in for example), and sends a hyperlink ...
0
votes
0answers
51 views
Persisting the output of HMAC instead of the session id?
Instead of persisting a random generated token I have seen a strategy of persisting the output of HMAC-SHA256 using the token and a private key instead.
Is the reason for using a hash function with ...
0
votes
0answers
251 views
Password-based client login over TCP/TLS
A client connects to a server through an application (not a web browser) with a long-running TCP connection. TLS is used, so the communication is secure.
Is there a standard way to implement a ...
6
votes
1answer
3k views
Changing session id after login
My web application is only accessible for authenticated users. Before login the user can only see the main page with a button to log in. The application assign a session ID on the main page, the ...
