2022 Developer Survey is open! Take survey.

Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
0 votes
1 answer
44 views

Session cookie security

I am creating a small login system. It looks like the standard username/pwd and user can either log or register. If they pass (authenticate), I create a session cookie that will be sent with the ...
user avatar
  • 15
0 votes
0 answers
32 views

Why do I have to store a refresh token in db

As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
user avatar
  • 1
2 votes
1 answer
34 views

use md5 hashed guid as app login and REST interface

We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest - api. All communication is over a secured https channel. The REST api is programmed to resist XSS ...
user avatar
  • 121
0 votes
1 answer
46 views

Session ID not changed after logging in/ logging out

I am testing website security when I came across this: When I enter the site URL, the user is given a session ID without any user input like: 7F746326038B30F51609423B2086BEBB Scenario 1: Once I ...
user avatar
0 votes
0 answers
53 views

Should other devices be required to login again after an email change in settings?

I have had multiple security researchers tell me that the best practice when a user changes their email in settings is to logout all other devices and force them to login again. Nobody has been able ...
user avatar
0 votes
1 answer
32 views

TLS session tickets between proxy and upstreams

I'm planning to implement (nginx) ssl_session_tickets in addition to ssl_session_cache between a proxy and upstream. They're not located in the same DC so TLS must be in place. My questions are : 1) ...
user avatar
0 votes
1 answer
45 views

Is passing an IDToken OK for seamless handover from app to website?

I am trying to assess the security implications for a session handover between an app and a website in the same company ecosystem. The Setup Mobile Application A and Website B use the same company ...
user avatar
  • 103
0 votes
0 answers
39 views

Should user session be restricted to a given IP? [duplicate]

If users are authentified with a sessionID (through cookies), would it increase security if we force users to log in again if for any reason their IP changed during their session? Or is this not worth ...
user avatar
  • 101
0 votes
1 answer
71 views

Multiple user sessions at the same time in a backoffice

I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management. The practice already has a backoffice-style software, but it's ...
user avatar
  • 1
2 votes
3 answers
169 views

Detecting session sharing with OAuth2

In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to ...
user avatar
0 votes
1 answer
89 views

Is there a secure way of handling online payments without user accounts and logging in?

I'm creating a subscription-based desktop application, but there is no authentication on the platform as the "user" is the computer upon which the application is installed. This means no ...
user avatar
1 vote
2 answers
108 views

How often to companies develop their own session management process?

I have been starting to read "The Application Hackers Handbook 2nd Edition" and just recently finished reading "Chapter 7: Attacking Session Management". Do companies develop their ...
user avatar
0 votes
1 answer
125 views

Why not use a long life session ID for auto-login instead of a persistent cookie with a token?

On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
user avatar
  • 1
0 votes
0 answers
65 views

Ways of Authentication in case server and client are hosted on different domains

I´m working on a project where user authentication is required. For some reasons we have to host the frontend and the backend on different domains. I usually send httponly cookies from server to ...
user avatar
  • 101
13 votes
1 answer
385 views

How do big websites (e.g. Google, Twitter, GitHub, ...) have practically infinite session lengths without compromising on security?

I'm currently implementing a login session system for a web application. I've read lots of articles recommending very low session and idle timeouts. For example OWASP says: Both the idle and absolute ...
user avatar
10 votes
1 answer
2k views

Is this a right technique to create and validate session tokens?

Current token format, creation, verification: vls_k3uGjFsDfA49Ygt8mqNHAtkBuUqRTU6K1KfUCwEiX9Z I am creating session token as follows: Create an array of 32 bytes. Fill the first 28 bytes via PRNG. ...
user avatar
  • 103
1 vote
1 answer
252 views

Hashing sessions and retrieving them using cookie(s) with session "id" and "token"

I'm implementing custom authentication & session management system in Node.js & PostgreSQL. My goal is to implement sessions that expire after 2 weeks (if not refreshed/renewed). OWASP and ...
user avatar
0 votes
1 answer
187 views

Logout functionality with JWT Session tokens

As per my understanding, JWTs are signed tokens which can be used to identify users, if used as session tokens, they can eliminate need to store session on server ie. they are stateless. Suppose I ...
user avatar
-1 votes
1 answer
96 views

Source of strange sessions

I stumbled upon some strange entries in our PHP sessions, they look like this: PHPREDIS_SESSION:${9923XXXXX+99XXXXXX} (<- I have changed some digits to 'X') PHPREDIS_SESSION:http://hitbXXXXXXXXXXX....
user avatar
  • 99
1 vote
2 answers
106 views

Protecting against cookie/session re-use with a sequence generator

I might be completely making this up as a solution or even feasible. I have a situation where a cookie exists for a browser/user/tab. In the background, while the user is viewing a page a request is ...
user avatar
0 votes
0 answers
18 views

They tell me if an attacker gets your session ID, can use it to pose as the legitimate user. Specifically HOW would they do that? [duplicate]

I understand changing session IDs is important so this doesn't happen. But nobody tells you HOW this attacker would actually do this? How would they get it ... then, more importantly, how would they ...
user avatar
2 votes
1 answer
403 views

Is the Guid.NewGuid method in .NET secure enough to be a session id?

At the company I work at, we use the output of the Guid.NewGuid method as a session id. So when a customer logs into our website, the output of Guid.NewGuid becomes the customer's session id and is ...
user avatar
4 votes
2 answers
509 views

Do I still need a CSRF token?

When a client makes the first request, I send a session ID cookie generated by the server as a string of 64 random bytes using getrandom(2) or /dev/urandom, stored in the database, with the flags ...
user avatar
  • 327
0 votes
1 answer
134 views

Am I writing a good login system? [closed]

I am designing a login system for my React app. All user data must be protected in case of a db leak. I only store encrypted data, with the exception of the email. To encrypt I need a key and I don't ...
user avatar
1 vote
1 answer
210 views

How do you make sure a session token is expired when a browser might use "session restore"

I was reading this article about session tokens from Mozilla's Developer website. Historically, I've always assumed that a session token set with a blank expiry (or one set to zero) would expire at ...
user avatar
  • 41
0 votes
0 answers
66 views

ADFS - Logout Functionality

The Microsoft Dynamics CRM based application uses Active Directory for authentication and session management. The session cookie however remains valid for the regular cookie expiration time. Even ...
user avatar
1 vote
1 answer
198 views

When generating user session tokens, should i bother checking for a duplicate?

In a program i am writing, i use session authentication tokens that we give back to a user to have them hand in with their requests. This is working very well but this question is about the generated ...
user avatar
  • 25
1 vote
3 answers
430 views

Is a simple random+hmac session cookie breakable?

I make session cookies of form session_id+'|'+hmac_sha256(session_id, static_secret) where session_id = random_string(16 bytes) made with a PRNG (not a CSPRNG!) seeded on the server's timestamp at ...
user avatar
  • 113
0 votes
2 answers
829 views

Storing Session Id in application logs

Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId? ...
user avatar
  • 103
1 vote
0 answers
122 views

Is it bad practice to use only one token for a SPA (no applications, only user)?

Say we have multiple instances of application X deployed on site1.com, site2.com, site3.com, etc. And we have a centralized server at example.com serving all of these. All the instances of X are ...
user avatar
0 votes
1 answer
221 views

Is ProtonMail implemented a mechanism to prevent cookies stealing?

I want to check if I can steal my own ProtonMail cookies. I connect to my account, I delete the cookie named AUTH-x12334xxxaazzzrf6567788ddd (cookie name is randomized name). I refresh the page and as ...
user avatar
  • 284
1 vote
3 answers
113 views

Current session cookie shown in a HTML page on request

A website exposes this function: https://test.com/getSessionCookie When an authenticated user clicks on it he gets an html page with his cookie. Could be this exploited in some ways?
user avatar
  • 477
1 vote
1 answer
172 views

What exactly are the session injection concerns when using Firebase Signin Links?

I'm guessing this applies to all implementations of sign-in links, but since I'm using Firebase I'd like to understand their concerns: https://firebase.google.com/docs/auth/web/email-link-auth#...
user avatar
  • 13
1 vote
1 answer
139 views

How to handle session absolute lifetime during user activity?

I'm implementing a web login system and am confused about how to think about when authenticated sessions (not just browser sessions) should be expired. There seem to be 2 factors: absolute lifetime ...
user avatar
3 votes
2 answers
122 views

Does limiting a web session to one browser window or tab provide added security?

A certain tax website has the frustrating feature of limiting the session to only one browser tab or window at a time. I haven't looked into how they might be doing this, but if you login on one tab, ...
user avatar
  • 131
1 vote
1 answer
516 views

Cookieless Authentication

I am working on an authentication server that can act as a central place to manage authentication for multiple projects, sort of like keycloak or ory kratos. While working on implementing ...
user avatar
1 vote
0 answers
89 views

mORMot 1.18 doesn't invalidate session_signature after logout? is this the default behaviour?

On a website which uses mORMot 1.18 every request made by an authenticated user is in this format: ../search_items?session_signature=0000004C000F6DD02E24541C as reported within the framework docs ...
user avatar
  • 477
1 vote
1 answer
312 views

What is the best way to go about generating a “token” for user authentication

Let's say I have a MySQL database with thousands of user accounts in it. These accounts contain lots of data, but for verification purposes, they each contain a username and a (hashed and salted) ...
user avatar
1 vote
1 answer
1k views

Encryption/decryption at client or server side with hybrid cryptosystem?

I've read a lot of documentations about encryption in the last weeks and I think I now have a good idea of what system I will use for my project (standard hybrid cryptosystem using RSA/AES). However, ...
user avatar
0 votes
1 answer
475 views

How to securely store and use session IDs

I'm not sure what's the option to store and manage session IDs for long lived sessions (3-6 months each). Given that the session ID is generated with enough entropy and that the session ID is then ...
user avatar
1 vote
0 answers
97 views

Change of domain without having to log in again

The question concerns the idea of transferring sessions between domains without having to log in again. I would like to do it like this: (user is logged in and changes the language to a language from ...
user avatar
1 vote
1 answer
507 views

How do I maintain/check a user session in the backend without having to use tokens?

I'm trying to login a user and, then, retrieve the user information like we do on a regular web app using php session. I have searched some solutions but I couldn't find any answer for my problem/...
user avatar
1 vote
0 answers
148 views

Can I use a persistent SID cookie for 'remember me'?

For the moment I implemented a login form asking for a username and a password and returning a session id (SID) that is stored in a cookie, without setting max_age or expires so that it will be ...
user avatar
  • 121
0 votes
0 answers
75 views

TLS Session Resumption for static content and JavaScript

This is an observation of SSL/TLS Resumption that maybe someone can help explain why SSL/TLS resumption is NOT shared between static assets and Javascript. Basically, I tested using two pages: pageA ...
user avatar
0 votes
0 answers
83 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
user avatar
  • 51
1 vote
0 answers
87 views

Can a sudo account access my browser sessions (e.g. Stack Exchange) remotely? [duplicate]

Suppose I am logged in to Stack Exchange on Firefox on my work computer. This session is clearly stored as a cookie (or something else), because it persists when I reboot the computer. I have sudo ...
user avatar
  • 141
0 votes
1 answer
2k views

Is it possible to bypass httponly?

I read some articles about XSS and how to mitigate the flaws in a web application. I've seen the HttpOnly on Set-Cookie. Can this flag be bypassed? Or is there another way to access a session cookie? ...
user avatar
0 votes
1 answer
254 views

Logout on OIDC Provider Refresh Token validity in comparison to OAuth

I have an Relying Party that has obtained an Access Token and Refresh Token (as well as an ID Token) from an OpenID Provider (not an offline token). In all cases I have seen, the Refresh Token is ...
user avatar
  • 502
0 votes
0 answers
108 views

Is there a good reason not to track valid JWTs in a key value store like redis?

I use Redis to track valid JWTs by saving the JTI (uuid-v4) mapped to the users id in Redis. If the JTI can not be found in Redis or the user id in Redis does not match the user id in the JWT the ...
user avatar
2 votes
1 answer
442 views

What else can be used instead of an API Key to protect resources in a REST API as is implied by OWASP?

I was reading the OWASP Cheat Sheet Series, specifically their cheat sheet for REST Security and one of the points they had under the section for API Keys was: Do not rely exclusively on API keys to ...
user avatar
  • 217

1
2 3 4 5
12