Questions tagged [session-management]
Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user
510
questions
0
votes
0answers
43 views
Web Browser Forgetting Between Users
I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
1
vote
0answers
40 views
Can a sudo account access my browser sessions (e.g. Stack Exchange) remotely? [duplicate]
Suppose I am logged in to Stack Exchange on Firefox on my work computer. This session is clearly stored as a cookie (or something else), because it persists when I reboot the computer. I have sudo ...
0
votes
1answer
43 views
Logout on OIDC Provider Refresh Token validity in comparison to OAuth
I have an Relying Party that has obtained an Access Token and Refresh Token (as well as an ID Token) from an OpenID Provider (not an offline token).
In all cases I have seen, the Refresh Token is ...
0
votes
0answers
40 views
Is there a good reason not to track valid JWTs in a key value store like redis?
I use Redis to track valid JWTs by saving the JTI (uuid-v4) mapped to the users id in Redis.
If the JTI can not be found in Redis or the user id in Redis does not match the user id in the JWT
the ...
2
votes
1answer
88 views
What else can be used instead of an API Key to protect resources in a REST API as is implied by OWASP?
I was reading the OWASP Cheat Sheet Series, specifically their cheat sheet for REST Security and one of the points they had under the section for API Keys was:
Do not rely exclusively on API keys to ...
0
votes
0answers
39 views
Designing a user session API for both mobile and web clients
I'm currently working on a project. The apis on the backend will support both mobile and web clients. I'm attempting to design a user management flow for both clients and a bit confused about how to ...
1
vote
1answer
58 views
If we're signing the id we send to the client, why not send the user id instead of session id?
I am learning about auth and session management, and using express-session in Node js. I am not able to find the need for this package. I read a about it online, but didn't get a satisfying answer. ...
1
vote
0answers
88 views
What's the latest thinking on website session expiry time? [closed]
Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
0
votes
0answers
53 views
Can python be used to retrieve a session ID to mimic logged in user at periodical times?
Let me quickly explain and then ask the question. I'm developing a Web Vulnerability assessment scanner for a project, and I'm learning python as I go, so forgive me if it might sound like a dumb ...
0
votes
1answer
78 views
Is there non human risk related to idle sessions?
Let's say the OS is Windows or Linux
As a System Admin, I think the answer to this question is : NO
I always configure end users machine for auto lockout for a given idle session time. Because I'm ...
3
votes
1answer
89 views
Does a website's session key have to be unguessable if it's signed?
I'm creating (what I believe to be) a cryptographically hard to guess session key to keep my users logged in by generating 32 random bytes (using crypto.randomBytes). I'm storing this in a cookie (as ...
1
vote
0answers
54 views
How can I implement CSRF Tokens without server-side rendering/templating?
I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
0answers
63 views
OpenId Connect Authorization Code Flow, using refresh token to renew id_token? And subsequently issueing a new cookie
I am currently working on implementing a proof of concept for ADFS (2019) (which I managed succesfully) and Azure AD with renewing the cookie / id_token by doing a refresh_token call in the backend of ...
0
votes
0answers
56 views
Caching session id. Should be this reported?
BACKGROUND:
I'm reading the OWASP testing guide for web applications
Session ID should never be sent over unencrypted transport and should never be cached.
...
Furthermore, whenever the Session ID ...
1
vote
1answer
52 views
Sessions With JWT
I'm currently implementing a REST Api for a Single Page Application and Mobile App. Any 3rd party login or grant access to them is not required.
I've microservices behind a gateway (all HTTPS).
My ...
1
vote
0answers
64 views
How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?
From PHP Session Management basics:
Proper use of session.use_only_cookies and session_regenerate_id() can
cause personal DoS with undeletable cookies set by attackers. In this
case, developers may ...
1
vote
0answers
54 views
Explanation for maldetect advice
I received a notice from maldetect on an Apache machine I'm running, and I've not seen an advice like this before. I'd like to get a better understanding of exactly what I am looking at. I received ...
0
votes
0answers
61 views
What is the term for data leaking from one HTTP request to another and how to prevent it?
Context
We recently added a feature that used a library whose API we misunderstood. Long story short, if user A sends a request to our web application, the library caches some result, and that result ...
0
votes
0answers
44 views
What if session cookie is stolen? Doesn't it have a similar effect with getting access token stolen
Most security specialist teams, OWASP, Auth0, Okta to name some, agree on that keeping access token in browser should be avoided. And one of the alternatives to this approach is having a proxy server ...
0
votes
0answers
76 views
Simplest secure way to create session cookies
Background: I've been using a simple session cookie design for my web app. I have a users table, and a sessions table that basically looks like this:
id | user_id | visited_at
-----+---------+-------...
0
votes
2answers
329 views
Is it safe to store session state of different apps in single Redis cluster?
We have "web app as a service" offering. And right now each app has its Redis which stores session data.
Is it secure if we use one redis cluster for all clients using this app.
To be clear ...
3
votes
0answers
95 views
Should you terminate a session when an incorrect CSRF token is submitted?
According to the OWASP CSRF Prevention Guide if the server fails to
...verify the existence and validity of the token in the request
compared to the token found in the user session ... then the ...
3
votes
4answers
395 views
Passing plain text password over HTTPS
My login for POST is over HTTPS. Therefore, I don't do anything to the provided password before submitting. And I don't see an issue there unless someone is watching your browser's developer console. (...
-1
votes
2answers
311 views
This client doesn't verify which representation it requested, while expecting a specific one. What are the security implications? [closed]
I am currently investigating a mobile app API.
There is a feature which fills in a form in the app automatically.
The user supplies a string which contains all the compressed form data.
And then the ...
0
votes
1answer
69 views
Are encrypted cookies over http safe? [duplicate]
I am new to cookies. My understanding of encrypted cookies is that a server can store info. at client side without the client knowing about its contents. Now, let us say a server generates ...
1
vote
1answer
189 views
What is the connection between CORS and SameSite cookie attribute?
For most of them may be its a silly question but I want it to know this in very simple language.
If an application is not using CORS at all then should we put this SameSite cookie attribute?
and if ...
0
votes
1answer
47 views
Same session cookies for a user logging from different browser/machine
I am new to web application security and have a few doubts regarding session cookies.
Which of these is considered more vulnerable:
Having the same session cookies for a user logging in from ...
2
votes
2answers
154 views
What attacks are httpOnly cookies intended to prevent?
I know that HttpOnly attribute restricts the cookie from being accessed by JavaScript etc. Is there any specific attacks regarding this issue? Can cookie theft and hijacking be counted as attacks ...
1
vote
1answer
69 views
What are the security risks of storing user roles/types in a cookie?
Recently I had to use a website which stored things like user role (user or admin) in a cookie.
When I modified the username the displayed username changed in the website.
I immediately asked the ...
1
vote
0answers
82 views
Are JWT still not recommended for sessions?
It seems there is a large divide as to wether or not you should have JWT or Session ID for managing user session on WebApp/API (for a web front end or/and a mobile app).
It seems that the consensus ...
0
votes
2answers
45 views
is it safe to implement custom way of storing cookie in android?
i want to store session information in android application temporarily (as long as application is running). i am sending real-time data to node.js server from android client using Custom Protocol (...
10
votes
3answers
268 views
Risks of Long-life Session
Most "big" websites seem to have enormous sessions. From looking through the cookies, Stack Exchange seems to have a one-week rolling session, GitHub has 45 days, and Gmail seems to have a never-...
2
votes
2answers
180 views
Should a SAML Assertion whose SessionNotOnOrAfter value is exactly the same value as its AuthnInstant be treated as having an invalid session?
I am receiving SOAP requests with SAML AuthnStatements whose SessionNotOnOrAfter timestamp is EXACTLY the same value as its AuthnInstant:
<saml:AuthnStatement AuthnInstant="2020-04-22T21:11:41....
1
vote
1answer
47 views
Supporting deep links in a web application without permitting session theft
I have a question about "session-theft" and the supporting of "deep links" in a web application, and best practice.
Our web application has a small number of front-door public web pages (e.g. /...
3
votes
4answers
669 views
How to securely set a cookie on another subdomain?
I have a microservice app. hub.example.com handles authentication. When a users logs in, I need to set a cookie on learn.example.com What is a secure way to set this? I'm aware of a few approaches:
...
0
votes
0answers
43 views
TLS Session ID from Client's First Visit
Why would a client send a TLS session ID (96b839ce3aadb65780923d28a3e7e767fc5bddc507884a7e70e506d8b85a06d3 on its first visit to a server/website? My understanding is that the client would include a ...
0
votes
0answers
27 views
Replay-Resistant Stateful Session Handling
I am currently creating an RPC server using gRPC and want a secure way to handle session tokens. I am currently using stateful session handling, where the user logs on and the server replies with an ...
1
vote
1answer
295 views
Using a persistent httpOnly cookie for authentication? (SPA)
So I'm building an application that needs authentication, I'm wondering if there's an security concerns with using a persistent httpOnly cookie to store user authentication with a SPA? (only 1 server. ...
0
votes
2answers
73 views
Is it safe to save a user's email into php session variable for later use?
I'm in the process of creating a password reset functionality for my project. I currently have my website send a password reset link to the user's email if they request it and validates the link ...
1
vote
1answer
104 views
Is it a security risk to strore item IDs in sessionStorage?
I've been working on an eCommerce store for people to be able to buy items. I want to implement a basket system for this store.
Looking at lots of other posts, it is clear to me that there are ...
1
vote
1answer
64 views
How to ensure JWT security in authentication?
I have implemented a backend as a REST API. To maintain the statelessness in REST, I intend to use JWT to verify that that a user has logged in or not.
(A user is logged in if a valid token is present ...
0
votes
0answers
28 views
how this default Session ID can be malicious or cause unintended results in application
I was looking the docs on what damages can be done by hackers if default Session ID is revealed in web application.
2
votes
1answer
109 views
Double JWT submit method
I'm implementing my JWT method by using the double submit method: where we separate the payload & header portion of the JWT from the signature.
The header & payload is stored in a separate ...
27
votes
5answers
8k views
Should concurrent logins be allowed?
We have a web app (Django) that logs users out if they haven't made a request within 1 hour.
From a security point of view, is it good practice to also block concurrent log ins?
In other words, if a ...
1
vote
2answers
2k views
If I am using a VPN with allowed multiple connections can each user/device be able to view traffic of the other user?
If I am using one a VPN Service, but it allows up to lets say 8 devices to connect, are all the devices/users able to view traffic from other users/devices?
Or is each VPN connection creating its own ...
0
votes
3answers
100 views
Sending static registration links via email
In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
1
vote
1answer
155 views
Session sync between two web apps on the same domain
I have a Laravel 6 site, and a legacy Drupal 7 site. Both are served under the same domain, and both share the same user database table.
I'd like users to be able to log in via Laravel (never via ...
4
votes
1answer
1k views
Is session/cookie based authentication stateful or stateless?
Flask Web Development says
The current login functionality implemented with the help of Flask-Login stores data
in the user session, which Flask stores by default in a client-side cookie, so the ...
1
vote
2answers
75 views
Should I avoid authenticating the user unnecessarily to a server?
I’m thinking a RESTful client–server architecture. There will be routes that require users to authenticate before they can access the resource (e.g. creating or editing resources). Other resources are ...
0
votes
0answers
87 views
Firebase token storage on logout
We are looking to implement push notifications for things like when a user receives an internal message within our app. We have an application with sensitive data so we have a short length inactivity ...
