Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

learn more… | top users | synonyms

0
votes
2answers
59 views

Why not have an identical session cookie for different user's devices?

Here is my table structure: // users +----+--------+------------------------+------------------+-------------------------------+ | id | name | email | cookie | /* some ...
0
votes
1answer
47 views

Is Tomcat session ID generation FIPS compliant?

I am trying to achieve the following security rule server must generate a unique session identifier using a FIPS 140-2 approved random number generator. I am using Tomcat 7.0.68 for my server, I am ...
3
votes
1answer
42 views

Should a corporate laptop client-server VPN connection last for days?

I was experimenting over the past few days with letting my laptop hibernate vs. shutting down on a daily basis (I have always been a shutdown guy, but am trying to update myself). While on business ...
1
vote
1answer
85 views

How to protect the Session ID?

I have been doing some reading over the past few days on Session IDs and the methods taken to prevent people from intercepting them and using them to hijack a session. From what I have read, when ...
-1
votes
0answers
76 views

What is a WAM style session token?

Does anybody know what a WAM session token is? This appears to be something related to ping-identity; but I am just wondering whether this is a standard or not. If you know about this, please do also ...
4
votes
0answers
101 views

PHP Session Vulnerability

I'm trying to solve a challenge on a CTF, with PHP sessions. The goal is to make check.php echo $_PASSWORD. I do not have access to the files themselves, and therefore I cannot edit them. My ...
1
vote
1answer
37 views

Risk in not expiring an “unsubscribe” link

Are there any risks with an "unsubscribe" link in e-mails that never expires? The e-mails are sent to customers. The token used to unsubscribe the customer will include a customer ID encoded using ...
0
votes
1answer
53 views

SSL session protocol vs SSL connection protocol

Slide 8, SSL Session Protocol: Slide 10, SSL connection protocol: Firstly, in Session Protocol, there is a {S}_B, what is the function of this {S}_B? Does't it help in proving Alice's identity? ...
3
votes
1answer
76 views

Fear regarding session tokens

I have read recently that sessions work as follows: Your credentials are checked. A token is generated and stored on server side, eg UUID, and this token is given to the client where it is stored ...
0
votes
1answer
41 views

Site stores cookie name and user id in script tag after login. Is this an issue for either xss or session highjack?

Upfront I will say that this is not my website and that I am simply doing a general audit (for non security issues), but ran across this in the source after logging in. Another script tag for ...
2
votes
1answer
47 views

Cross-domain session standardization

I am looking into cross-domain sessions. These are sessions which are shared between two domains like google.com and spotify.com. I'm not looking for information regarding cross-domain sessions ...
4
votes
2answers
89 views

Is allowing users to sign out of all other sessions good or bad?

I'm not really sure if this feature is a good security idea, but would it be good to allow a user to sign out of all other sessions? Or would this be a bad idea, because I see a good amount of pros, ...
1
vote
3answers
143 views

Asp.net web forms is not generating a new session id if a user logs out and logs back in

Asp.net web forms is not generating a new session id if a user logs out and logs back in. Is this a major security risk? We're using SSL.
0
votes
1answer
127 views

How is UDP hijacking even possible?

My doubt is this: UDP has no sequence numbers, so what indeed is the concept behind UDP session hijacking?
1
vote
2answers
47 views

Is this a session fixation

I really can't understand the session fixation attack. I've read OWASP definition that said: Session Fixation is an attack that permits an attacker to hijack a valid user session. The attack ...
2
votes
2answers
146 views

Is it bad if session key is passed in plain text in URL?

In a class we were told that it's dangerous to put the session key in the URL because it could be cached, either by the browser or a proxy etc. Is this correct? Even if it was cached shouldn't the ...
3
votes
2answers
179 views

In which OSI layer does session hijacking occur?

In which layer of the OSI model does session hijacking occur? I have performed some research on this, and found that the answer is the transport layer. But is the transport layer not the place ...
3
votes
1answer
63 views

How to prevent data from Interception?

I am a web developer. A few days ago, I used Burp, to intercept facebook's official App over network, by setting up proxy. I noticed that the data was encrypted. While I have been using Json to ...
1
vote
1answer
33 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
3
votes
1answer
110 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
1
vote
2answers
150 views

Prevent Session Hijacking, where an attacker steals Session ID(cookie) from the browser physically

Consider a case, where an attacker has physical access of user's machine for 20-30 seconds. The attacker can use this time to steal user's cookie (say using EditThisCookie plugin) and send the cookies ...
1
vote
2answers
125 views

When should server side sessions be used instead of client side sessions?

From an information security perspective, when should server side sessions be enabled instead of client side sessions? From what I gather, "secure client side sessions" are cookies that contain data ...
0
votes
1answer
126 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ("Cache-Control:no-cache"...
1
vote
1answer
80 views

Handling session tokens when a users IP changes with extreme frequency

My web service is an API-driven Single-Page-Application. Once the user logs in they're given a temporary token to use for the rest of the session which is sent along with each API request. The token ...
1
vote
4answers
151 views

Why is MITM required for Session Hijacking?

As I understand, the basic concept of Session Hijacking is intercepting a packet in which the victim sends its cookie/session credentials to a server, be it Facebook/Twitter/YouTube/Whatever. But ...
0
votes
1answer
79 views

OpenSSL gmail - receiving Please log in via your web browser and then try again

Using openssl as below when I do EHLO auth login and then enter my username and password I get the following error: Please log in via your web browser and then try again. Learn ...
2
votes
1answer
299 views

Single Page Application session management

I have a Single Page Application which is fully HTML+JS+CSS (using frameworks such as jQuery and AngularJS) and a server side API using ASP.NET WebApi. The SPA is served in a server similar to a CDN ...
3
votes
0answers
63 views

How to group user actions within the same session?

I'm working on enterprise application where it's needed to audit all user actions (data modification, settings changing etc.) within their work session. What is the best way to group all that actions ...
0
votes
0answers
20 views

Cookies carrying Session identifiers

Is there a list of names for cookies carrying SID's? For instance: PHP by default uses PHPSESSIONID Tomcat uses JSESSIONID ... I would like to be able to intercepts all SID's supplied via ...
8
votes
3answers
709 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
5
votes
2answers
1k views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
2
votes
2answers
356 views

Why does OWASP recommend “Disable Web Browser Cross-Tab Sessions”

I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same ...
8
votes
4answers
1k views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
0
votes
4answers
140 views

Is session expiration for all web applications possible?

In case someone visits an infected site his safety, if his cookies get stolen, may be compromised. Is there any abstract way to expire a session on the stolen session-id so that the id is practically ...
1
vote
0answers
48 views

PHP session and page data inconsistencies [closed]

I have a problem and I'm not immediately sure how to go about resolving it. I have been building a secured login system on a HTTPS server (with a grade of "A" by SSL-labs, if that's worth anything ),...
0
votes
2answers
59 views

Is it insecure to temporarily save user's data in a session while they register?

My plan is to save the registration, as they go along so if they close the page by accident they will still have all of there information saved so they can continue it again. But my question is it ...
1
vote
1answer
301 views

Session Expiry due to weblogic.xml for mitigation of cookie hijacking? [closed]

To ensure strict security at web application, we tried to mitigate cookie hijacking by adding code to weblogic.xml. Following is what we did: Example that we had applied on weblogic.xml and faced ...
3
votes
1answer
173 views

SSL session ID in TLS ticket based resumption

We have a server which supports TLS ticket based stateless session resumption. However, when I connect to the server using openssl s_client, I still see a session ID being generated along with the TLS ...
4
votes
2answers
129 views

How much data should I store on a user's computer about their login info?

I'm currently saving a user's "login" information (not their raw password, of course!). Every device/browser gets its own secure ID from the server, all well and good. However, should I verify more ...
2
votes
1answer
179 views

Use salt as identifier for crypted session id in database based authentication system for webapp

I have written a database-based authentication framework for webapps I am planning to program in the future. The framework is implemented by using the plpgsql-language of a PostgreSQL-Database and ...
2
votes
1answer
96 views

TLS Session Tickets: What is the risk of a disclosed server ticket key?

So there is this TLS Session resumption method using Session Tickets which transfers the TLS server secret state to the client (encrypted and authenticated with a key only known to the server) If a ...
6
votes
2answers
132 views

Tie the session ID to the SSL session

The OWASP website says: Tie the session ID to the SSL session and provide configurable options for actions to take if the session ID is transmitted over a new SSL session. I am not sure if ...
7
votes
3answers
145 views

Are there any severe concerns of sending the user's login and password with each HTTPS request?

Due to certain requirements/constraints, I'm wondering about sending user login and password with each request. This somehow doesn't feel very good to me, though I think for my particular case, it ...
1
vote
1answer
147 views

cryptographic session token vs stored random session token [duplicate]

I am building a web API and I have a hard time choosing between cryptographic session token and stored random session token for user authentication. I see several pros & cons for each: stored ...
1
vote
2answers
484 views

Differences between Cookie vs Session Variable to sensitive data

I am doing my own login authentication system, and I want to do a robust system. I want to decide which direction I should take to keep the user logged in. I have put a question for each way, and also ...
0
votes
1answer
69 views

What TLS session resumption percentage?

I would like to plan a system and I am asking myself how is it going to influence my performance if I am not going to implement TLS session resumption. Does anyone measure how often is the use of TLS ...
3
votes
1answer
152 views

How can storing a userId as client-side-sessions be safe?

The documentation for session handling in ninjaFramework states: [...] Ninja uses so called client-side sessions. The cookie itself stores the information you want to attach to that session. [....
2
votes
1answer
131 views

Can I safely and securely store hash(sessionId) in application logs?

I'm considering storing a hash of a user's session ID in our applications logs on each request. This would allow users sessions to be easily tracked back to actions in our logs. I understand that ...
2
votes
1answer
97 views

Choosing token over session or vice versa?

I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about: I learned JWT, built a token, and sent ...
0
votes
2answers
95 views

Launch a game client with custom protocol and auto login the user using web server's session

I am creating a MOBA game and I will host tournaments which will be visible on the website. to join the game, you must be logged in on the website and browse the tournaments list and select a ...