Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
0 votes
1 answer
67 views

token leak by copying cookie

Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
Jacson - ANLS's user avatar
0 votes
1 answer
86 views

Authentication that immune to cookie hijacking [duplicate]

There is a website that uses a cookie to store the user’s session info. Let's assume that a hacker steals a user’s cookie to gain unauthorized access to their online accounts via some vulnerability. ...
Ghost Rider's user avatar
0 votes
0 answers
56 views

Prevent Session Hijacking with copying all metadata from a browser

For example, I'm signed in to my Gmail account. If I copy all data from all the places that Chrome uses (localstorage, all the cookies, all temp folders and so on) to another PC. How does Google ...
Ghost Rider's user avatar
0 votes
1 answer
188 views

Is there a problem with the use of HTTP cookies as auth tokens in mobile apps?

Imagine you have a website, for which you have configured a proper and secure session management / login system, using first-party / session cookies. Any interaction with that website is setup in the ...
DevelJoe's user avatar
  • 131
0 votes
1 answer
150 views

TLS session ticket vs pre-shared key state management

TLS 1.2 session tickets are encrypted by the server with the session ticket encryption key (STEK). This key is shared with all the servers doing TLS termination. The session ticket contains all the ...
user2233706's user avatar
0 votes
2 answers
134 views

Why do we use Session ID cookies on the web instead of a unique device identifier?

Session IDs aren't exactly secure, you can copy them from one device to another just by copying the browser's temp files. Techniques to tell apart one device from another have existed in browsers for ...
u7w2's user avatar
  • 1
1 vote
1 answer
56 views

Is Web session required for app security?

I understand that the idea of a session was conceived originally to improve user experience with Web applications. I also understand that session implementation can introduce attack vectors if not ...
postoronnim's user avatar
0 votes
1 answer
341 views

Identifying a session hijacking attack [closed]

I understand session hijacking has been a widespread attack vector in the past months. If an attacker steals a user’s session cookies, they can bypass 2FA and login/password. If this is the case, how ...
Mark O's user avatar
  • 3
0 votes
1 answer
118 views

What are the best practices to safely store OAuth2 tokens in a database?

I'm building a website with Patreon integration and I have identified the need to store Patreon user's OAuth2 token in the database. I'm wondering what's the best way to do that, security-wise. Some ...
Vilx-'s user avatar
  • 1,030
0 votes
0 answers
75 views

What type of token is this?

I started noticing this kind of token in a lot of CTF tasks from different authors: eyJlbWFpbCI6ImVtYWlsQG1haWxib3guZG9tYWluIiwiaWQiOjN9.ZLNCAQ.MxwKVKj_dramWyfT5XxT6g9U3xk The structure is as follows: ...
Andrey's user avatar
  • 3
2 votes
1 answer
230 views

Session Identifier: User-specific data in signed cookie vs Randomly generated session identifier

This question is inspired by looking at the functionality of the Flask-Login extension for the Python's Flask Framework (Web Framework). This extension generates a session identifier using the user's ...
WhiteFox's user avatar
0 votes
2 answers
53 views

My logged in status is being maintained 36 hours after initial login on an online account

Log in time outs can be a pain we all know. However maintaining "logged in" status whereby even if I refresh a previously open tab the next day (I hibernate my laptop each night so Chrome ...
martin_sv's user avatar
0 votes
2 answers
98 views

Security implications of using the current session to mint new access tokens

I saw a setup recently where frontend and resource servers were hosted on subdomains of the same second level domain. E.g. ui.example.com and api.example.com. It had an interesting authentication flow ...
Packager's user avatar
0 votes
1 answer
325 views

Session based CSRF Tokens - What value do i use with JWT?

The Double Submit Cookie CSRF Token pattern is a stateless technique that doesn't require storage or a database. However, it's vulnerable to session hijacking attacks and sub-/sibling domains that are ...
Advena's user avatar
  • 129
2 votes
1 answer
419 views

RDP logout necessary to prevent RDP session hijacking?

We recently got a strengthened security policy where people are required to log out of any RDP connections at the end of the day. So when I turn off my laptop, it is not enough to merely close the RDP ...
timppu's user avatar
  • 21
0 votes
2 answers
183 views

Protection against user session attacks (hijack, replay, tampering, CSRF, XSS...)

We develop a website in JAMStack, all URLs are static HTML page, and each interaction with the server are made by a fetch call on our REST API (micro-services). When a user sign in, we want to ...
lakano's user avatar
  • 157
2 votes
1 answer
201 views

Logout is just clearing cookies [closed]

My friend who is a web developer implemented his session management in a totally new way for me. He created a random sessionAPPID that is given to the user when he gives correct credentials. He then ...
rudeus123's user avatar
0 votes
1 answer
207 views

Google Security Cookies; Prevents cookie leak to malicious XHRs

Below is an excerpt from https://policies.google.com/technologies/cookies#security The ‘pm_sess’, ‘YSC’ and ‘AEC’ cookies ensure that requests within a browsing session are made by the user, and not ...
Aadithya V's user avatar
0 votes
0 answers
90 views

Is it worth replacing session based traditional auth with OpenID-Connect?

Details: traditional web-application with react frontend & nodejs API backend. FE & BE served on the same domain. FE -> example.com, API -> example.com/api We have users and some of the ...
Attila Kling's user avatar
4 votes
1 answer
373 views

REST API authorization

Let say you have a REST API, which you want to use as the backend for React application. The application supports user login. You use JWT authorization to make that REST API stateless. Now the problem ...
random_đov's user avatar
2 votes
5 answers
2k views

Session regeneration after password change?

So I understand the purpose of regenerating a session ID after a state change such as authenticating, i.e to prevent session fixation. What I'm not clear on is why this would be necessary after a ...
A J's user avatar
  • 21
0 votes
0 answers
409 views

Oauth: Authorizing multiple clients at once

I have an application where the frontend app talks to 2 set of API servers: be1.domain.com and be2.domain.com both these servers are independent entities (they do share the same top level domain, in ...
gaurav5430's user avatar
2 votes
0 answers
98 views

What would be the most complete procedure to get a simple login system working securely?

I don't have formal CS education but i've written one or 2 little websites. I have troubles communicating even in my native language but i hope this is understandable. With simple i mean something ...
Silly_Code_Valley's user avatar
3 votes
1 answer
2k views

Does Cache-Control: no-cache="Set-Cookie, Set-Cookie2" actually prevent caching cookies?

This OWASP recommendation says: it is highly recommended to use the Cache-Control: no-cache="Set-Cookie, Set-Cookie2" directive, to allow web clients to cache everything except the session ...
jacob's user avatar
  • 103
0 votes
1 answer
158 views

Session cookie security

I am creating a small login system. It looks like the standard username/pwd and user can either log or register. If they pass (authenticate), I create a session cookie that will be sent with the ...
Mah Neh's user avatar
  • 25
2 votes
0 answers
809 views

Why do I have to store a refresh token in db

As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
John's user avatar
  • 21
2 votes
1 answer
210 views

use md5 hashed guid as app login and REST interface

We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest - api. All communication is over a secured https channel. The REST api is programmed to resist XSS ...
theking2's user avatar
  • 147
0 votes
1 answer
2k views

Session ID not changed after logging in/ logging out

I am testing website security when I came across this: When I enter the site URL, the user is given a session ID without any user input like: 7F746326038B30F51609423B2086BEBB Scenario 1: Once I ...
Supraja's user avatar
0 votes
0 answers
502 views

Should other devices be required to login again after an email change in settings?

I have had multiple security researchers tell me that the best practice when a user changes their email in settings is to logout all other devices and force them to login again. Nobody has been able ...
anthonyryan1's user avatar
0 votes
1 answer
428 views

TLS session tickets between proxy and upstreams

I'm planning to implement (nginx) ssl_session_tickets in addition to ssl_session_cache between a proxy and upstream. They're not located in the same DC so TLS must be in place. My questions are : 1) ...
CrazyRabbit's user avatar
0 votes
1 answer
197 views

Is passing an IDToken OK for seamless handover from app to website?

I am trying to assess the security implications for a session handover between an app and a website in the same company ecosystem. The Setup Mobile Application A and Website B use the same company ...
Vankog's user avatar
  • 103
0 votes
0 answers
44 views

Should user session be restricted to a given IP? [duplicate]

If users are authentified with a sessionID (through cookies), would it increase security if we force users to log in again if for any reason their IP changed during their session? Or is this not worth ...
caub's user avatar
  • 101
2 votes
2 answers
463 views

Multiple user sessions at the same time in a backoffice

I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management. The practice already has a backoffice-style software, but it's ...
user avatar
2 votes
3 answers
796 views

Detecting session sharing with OAuth2

In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to ...
Rifa Achrinza's user avatar
1 vote
1 answer
222 views

Is there a secure way of handling online payments without user accounts and logging in?

I'm creating a subscription-based desktop application, but there is no authentication on the platform as the "user" is the computer upon which the application is installed. This means no ...
Gumptastic's user avatar
1 vote
2 answers
165 views

How often to companies develop their own session management process?

I have been starting to read "The Application Hackers Handbook 2nd Edition" and just recently finished reading "Chapter 7: Attacking Session Management". Do companies develop their ...
Emanuel Beni's user avatar
1 vote
1 answer
526 views

Why not use a long life session ID for auto-login instead of a persistent cookie with a token?

On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
iio7's user avatar
  • 11
18 votes
3 answers
1k views

How do big websites (e.g. Google, Twitter, GitHub, ...) have practically infinite session lengths without compromising on security?

I'm currently implementing a login session system for a web application. I've read lots of articles recommending very low session and idle timeouts. For example OWASP says: Both the idle and absolute ...
Lukas Kalbertodt's user avatar
12 votes
1 answer
3k views

Is this a right technique to create and validate session tokens?

Current token format, creation, verification: vls_k3uGjFsDfA49Ygt8mqNHAtkBuUqRTU6K1KfUCwEiX9Z I am creating session token as follows: Create an array of 32 bytes. Fill the first 28 bytes via PRNG. ...
neymecc's user avatar
  • 123
3 votes
3 answers
997 views

Hashing sessions and retrieving them using cookie(s) with session "id" and "token"

I'm implementing custom authentication & session management system in Node.js & PostgreSQL. My goal is to implement sessions that expire after 2 weeks (if not refreshed/renewed). OWASP and ...
Dominik Serafin's user avatar
0 votes
1 answer
2k views

Logout functionality with JWT Session tokens

As per my understanding, JWTs are signed tokens which can be used to identify users, if used as session tokens, they can eliminate need to store session on server ie. they are stateless. Suppose I ...
Abhishek Choudhary's user avatar
-1 votes
1 answer
125 views

Source of strange sessions

I stumbled upon some strange entries in our PHP sessions, they look like this: PHPREDIS_SESSION:${9923XXXXX+99XXXXXX} (<- I have changed some digits to 'X') PHPREDIS_SESSION:http://hitbXXXXXXXXXXX....
FelixHJ's user avatar
  • 99
1 vote
2 answers
191 views

Protecting against cookie/session re-use with a sequence generator

I might be completely making this up as a solution or even feasible. I have a situation where a cookie exists for a browser/user/tab. In the background, while the user is viewing a page a request is ...
amlwwalker's user avatar
3 votes
2 answers
2k views

Is the Guid.NewGuid method in .NET secure enough to be a session id?

At the company I work at, we use the output of the Guid.NewGuid method as a session id. So when a customer logs into our website, the output of Guid.NewGuid becomes the customer's session id and is ...
Weare Mwam's user avatar
4 votes
2 answers
2k views

Do I still need a CSRF token?

When a client makes the first request, I send a session ID cookie generated by the server as a string of 64 random bytes using getrandom(2) or /dev/urandom, stored in the database, with the flags ...
rid's user avatar
  • 329
0 votes
1 answer
146 views

Am I writing a good login system? [closed]

I am designing a login system for my React app. All user data must be protected in case of a db leak. I only store encrypted data, with the exception of the email. To encrypt I need a key and I don't ...
Kewyn Vieira's user avatar
1 vote
1 answer
1k views

How do you make sure a session token is expired when a browser might use "session restore"

I was reading this article about session tokens from Mozilla's Developer website. Historically, I've always assumed that a session token set with a blank expiry (or one set to zero) would expire at ...
Brewer's user avatar
  • 41
1 vote
1 answer
431 views

When generating user session tokens, should i bother checking for a duplicate?

In a program i am writing, i use session authentication tokens that we give back to a user to have them hand in with their requests. This is working very well but this question is about the generated ...
Necro's user avatar
  • 125
2 votes
3 answers
1k views

Is a simple random+hmac session cookie breakable?

I make session cookies of form session_id+'|'+hmac_sha256(session_id, static_secret) where session_id = random_string(16 bytes) made with a PRNG (not a CSPRNG!) seeded on the server's timestamp at ...
capr's user avatar
  • 123
1 vote
2 answers
3k views

Storing Session Id in application logs

Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId? ...
ramtech's user avatar
  • 113

1
2 3 4 5
12