Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user
5
votes
1answer
31 views
Understanding Session Fixation Vulnerability
What I've Read
I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability:
Ruby on Rails Security Guide § ...
2
votes
1answer
179 views
HeartBleed - how do I invalidate all session cookies?
As part of the Heartbleed event, I have upgraded OpenSSL, reissued and replaced certificates and revoked the old ones and changed passwords however, I am also seeing advice to invalidate all session ...
1
vote
0answers
52 views
Do I keep my PHP simple auth session secure enough?
I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
0
votes
1answer
97 views
Which approach to encrypting data on a per-user basis is more secure?
As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a ...
1
vote
1answer
204 views
Increasing tomcat session id increases security
Tomcat gives a configuration sessionIdLength to be configurable, but does increasing the session id increases its security or its just security through obscurity
1
vote
2answers
91 views
Is it safe to use Diffie-Hellman public keys as nonces to protect against replay attacks?
I have an interesting case regarding protection against replay attacks. Under the assumption that Alice and Bob have used Diffie-Hellman key exchange to establish a secure temporary session, would it ...
0
votes
1answer
52 views
Wouldn't transient cookies for session management increase effectiveness of MITM?
According to wikipedia, a transient cookie (aka session-cookie, in-memory cookie) is forgotten when the user closes the browser. These are also recommended for session cookies by OWASP.
I've seen a ...
-5
votes
4answers
130 views
user authentication my method (reinventing the wheel) is this secure?
I have read many articles advising to use OpenID, including Stack Overflow Q&A, for authentication. Unfortunately I can't use openid because my auth is not based on an email id - it is based on ...
2
votes
2answers
120 views
safe methods of generating session keys
So I have this web app where I'm supposed to generate my own session key to use in the session manager. I just have few questions about safe approaches to this.
I believe to make this safe it should ...
0
votes
1answer
47 views
How much harm can an attacker do on the Diffie-Hellman exchange?
I'm looking at a system that uses an unprotected Diffie-Hellman exchange to negotiate a key for the session encryption.
That Diffie-Hellman is not secure against man-in-the-middle attacks is textbook ...
2
votes
0answers
40 views
What causes wifi network connections to timeout? [closed]
i was wondering what actually causes wifi network connections to timeout. for instance, say my laptop is connected to my wifi and i yank the battery out such that my laptop can't send any proper ...
1
vote
0answers
136 views
Simple Session Management Across Multiple Application Servers
How should I handle authentication for a simple iPhone chat app?
Backend
I'm building the backend using two application servers:
Sinatra REST Server
It lists users & old messages.
Node.js ...
0
votes
1answer
934 views
SSL Handshake failed
I’m working on windows desktop application which is created using C++ (IDE : Qt creator). It has login panel, where i do user validation via https connection using openssl 1.0 library. Application is ...
2
votes
2answers
84 views
Can sessions be handled securely with cookies disabled?
I've been doing some reading here about session ID handling, and have learned that it's generally a bad idea to include a session ID in the HTML source code, and/or on the query string. For example Is ...
4
votes
4answers
389 views
avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?
Summary
Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
4
votes
2answers
304 views
Windows Authentication and Session Ids
After a penetration test made upon an intranet application I'm developing, in ASP.NET MVC, one of the concerns raised was that the application supports concurrent user sessions and it is recommended ...
4
votes
2answers
245 views
What type of information should be shown to an end user for a logon session summary?
Google, Yahoo, Facebook and several banks have a session summary screen that lists a variety of information, but they aren't consistent in what is offered to the end user. e.g.
Facebook offers a ...
1
vote
2answers
202 views
How long should a browser session last?
I have two online accounts from different banks, one bank expires my session faster than the other, it's quite annoying.
I was wondering how long (or short) should a session be for it to be ...
0
votes
1answer
189 views
What mechanism to use for simple and secure HTTP API access?
I am currently working on a service which offers a HTTP API for mobile clients.
I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be ...
2
votes
1answer
127 views
Session Cookie HttpOnly Set After Initial Server Response Showing as Vulnerable
Is a session cookie set without HttpOnly at first, but added before the client browser finishes rendering, still considered vulnerable? The scanner test I need to satisfy believes so, but is this a ...
6
votes
2answers
404 views
Modern, security-conscious, PHP book?
I posted this on StackOverflow and they redirected me here. Sorry if this isn't the correct area!
After creating a simple login system and trying to protect it against things like SQL injection, ...
1
vote
2answers
464 views
Centralize Linux System Management
We currently maintain several linux servers and are looking to employ sub contractors. However, we wan't to keep tabs on who does what on each server. Other then creating sudo accounts on every ...
0
votes
1answer
166 views
How does does the “Sign out all other sessions” feature work in Gmail?
In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they ...
6
votes
3answers
284 views
Vulnerabilities with DB backed session tokens
A user logs in and is given a session token. This token is also stored in a database on the server. The user includes this secret token with each request, and the server will pull it from the DB to ...
1
vote
1answer
193 views
Preventive Measure for detecting Session Fixation attacks
From my understanding if i am not wrong in session fixation attacks. The attacker login into the server as a legitimate user and creates a valid session. He then the tricks the compromised user to use ...
0
votes
2answers
187 views
Are there any HTTP servers that can detect two cookies with the same name, but issued from different subdomains?
As a follow up to the Related Domain Cookie Attack question, I'd like to see if there are any servers that are able to detect instances where multiple cookies are sent from multiple domains.
In other ...
14
votes
2answers
432 views
Does it make sense to hash a session id before passing it to an advertisement partner?
My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
6
votes
2answers
520 views
Session Cookie Stealing Protection
I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used:
HTTPS Everywhere
Only use a securely created random ...
3
votes
3answers
305 views
Can I safely use an encrypted URL parameter for the session id?
I'm planning to send a user's session ID as a URL parameter which will be AES encrypted. I don't think my app has any link sharing problems. Is this idea feasible? Is it safe?
5
votes
2answers
162 views
What are the tradeoffs in allowing logouts of other logged-in sessions?
For instance, Gmail has allowed remote logout since 2008. I think I have seen other sites that allow you to log out all other logged-in sessions.
What are the tradeoffs to consider in this session ...
4
votes
2answers
203 views
Does the ability for a user to choose the value of a session id cookie constitute a security flaw?
In the context of a web application, a user connects to this application and a session id cookie is set to authenticate the user for next requests. As the cookie is actually present before submitting ...
-6
votes
1answer
169 views
What are the valid characters which can be present in a session ID [can it have spaces] [closed]
I need to know what will the valid characters in a session id or in particular whether it can have spaces in it .?
5
votes
0answers
375 views
Webapp2 security
I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and ...
3
votes
3answers
462 views
Secure login system - using sessions?
I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this:
<?php
session_start();
if (validPass() || isset($_SESSION['userId'])) {
...
1
vote
3answers
3k views
What typically is the expiration date of a session cookie?
I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
0
votes
1answer
92 views
Implementing secure login for an API
I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
2
votes
4answers
355 views
When logging out of a website is anything else required then destroying the session?
In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out.
session_start();
session_destroy();
Is there anything else that needs to be done?
EDIT: I ...
2
votes
2answers
94 views
Actual issue? Phone switches from 3G to router makes session switch from https to http
I heard that a security issue exists in some cases when a mobile phone has:
Connected to a website via https via 3G
Connects to a router
I'm told that that in this particular scenario the router ...
18
votes
4answers
6k views
Demystifying Web Authentication (Stateless Session Cookies)
I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages.
Here is my first ...
3
votes
4answers
206 views
Securing opensource web application
I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
1
vote
1answer
467 views
Are there modules to harden Symfony 2 sessions?
We're looking at building a new app on top of Symfony 2, but security is our top priority. After digging around a bit, it seems that there are a number of built-in options for Session management (eg ...
0
votes
3answers
150 views
Maintain sensitive key between requests
EDIT: Reworked question. Previous version too poorly asked.
On my website users write sensitive messages that must be kept secret.
The entire user area is over SSL, so the communication between user ...
4
votes
2answers
301 views
Any real world examples of GPS location data being used with authentication?
Are there any examples of how GPS coordinate (or any location data really) can be used to detect suspicious locations or validate well known locations?
Specifically
Highlighting new or unusual ...
7
votes
3answers
4k views
Choosing a session ID algorithm for a client-server relationship
I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
2
votes
1answer
2k views
Stopping Session Hijacking
If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
9
votes
2answers
2k views
Keeping user session alive - security considerations
We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
4
votes
3answers
135 views
Getting automatically logged in to others session via WIFI
Recently i got a very strange behavior on our WIFI network: We share a WIFI network with a simple router. One of us pays the bills and he's the one, who got the management account from our ISP. So if ...
5
votes
2answers
2k views
Best way to securely set a session cookie on another domain
We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com.
The www site does not have an SSL certificate and is on a different domain.
We have a login button on http://www.foo.co.uk ...
2
votes
2answers
237 views
How attacker can access victim's account without knowing its credentials?
I want to login facebook from a wifi connection and check sign-in page is over https but later when i don't pay attention to address bar (for example when playing games and click on links like a crazy ...
1
vote
2answers
1k views
How to invalidate a session on browser closure?
I have a web application where web session need to expire after stipulated period of time. However capturing browser closure event is not a good idea to invalidate a user session.
What can be an ...
