Questions tagged [session-management]
Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user
439
questions
0
votes
2answers
44 views
Is a web app vulnerable if it only uses session token in cookie to authenticate a user
I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability.
The ...
0
votes
0answers
26 views
Can I rely on Google id_token for web session?
I'm building a website without a "server": JavaScript and AWS Lambdas as back-end through API Gateway.
Knowing there is no solution for session when using lambdas, I was wondering if I could only use ...
2
votes
3answers
57 views
Is it advisable to tie different capabilities to different session tokens?
Let's say you're creating a banking web application with mobile apps. A bank user has permissions "transfer money" and "view balances." When a user logs in, we can create a session token (typical ...
2
votes
1answer
92 views
Firefox 68 — any changes affecting CSRF capabilities?
My Ubuntu 18 system did an upgrade to Firefox 68 (presumably from 67.x).
I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid ...
1
vote
0answers
32 views
Configure Burp to pass dynamic authentication token from the past response to the next request in intruder
I would like to reuse an authentication token (which is dynamic) between a response and a request in Burp Suite intruder.
By dynamic I mean that the token is invalidated after being sent to the ...
1
vote
1answer
99 views
Why sign session cookies? [duplicate]
I'm using express-session middleware to store sessions on the server. The client's browser gets a cookie with the session ID. A secret is required in the configuration; it is used to sign the session ...
0
votes
1answer
45 views
Is it a bad practice to send sensitive information(like a session id) in the aspx response?
Lets say I have an aspx login page which validates user credentials, obtains a session id and then redirects to the home page in the following way.
login.aspx:
var sessionId = ValidateCredentials();
...
0
votes
2answers
57 views
What is the most secure way to store cross subdomain cookies
I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
2
votes
1answer
130 views
Is there any benefit to using a salt when the cleartext is random data?
I understand that using a salt makes it harder to find cleartext using rainbow tables - but in that scenario the clear text is structured / low entropy. If my clear text is generated randomly, then is ...
0
votes
1answer
41 views
Cancelling a request stops new authentication cookie getting to browser, invalidating all further requests
I am trying to secure my login system using authentication cookies.
If the user tries to access a protected resource they must provide an authentication cookie. If the cookie is valid, the request is ...
0
votes
2answers
81 views
Is there another way than session hijacking to access user account through XSS?
If I have discovered an XSS vulnerability, is there another way of gaining access to an account without session hijacking? Mainly because on most of the sites I test, the HttpOnly and Secure flags are ...
0
votes
2answers
66 views
Are JWT's the way to go in my situation?
I am working on a personal project for learning reasons, and have come to the point of authenticating and authorizing users. I would like to keep the project as stateless as possible, to make sure it ...
0
votes
1answer
53 views
OIDC SPA Keycloack refresh_token storage location
I have Single Page Application based on Open ID Connect flow (keycloak).
I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
1
vote
1answer
63 views
Is it recommended to send an authentication request to the Resource Owner (by the Authorization Server) if it already has an active session?
In OAuth 2.0 Authorization Code Flow (Grant Type), is it recommended (or is it maybe even a best practice) to send an authentication request (e.g. a login-request form) to the Resource Owner (by the ...
2
votes
1answer
154 views
How could ASP.NET forms authentication session leak into a different site?
We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site. I can't figure out how is IIS or ASP.NET allowing this to occur
Steps:
Login to ...
2
votes
3answers
317 views
Why are ASP.NET form authentication cookies deleted only on client side if client side can't be trusted?
ASP.NET documentation says:
FormsAuthentication.SignOut()
Removes the forms-authentication ticket from the browser
Why is the cookie not invalidated at the server as well? It would be easy ...
0
votes
1answer
96 views
Is session id in url itself for all the requests an issue? [closed]
Is session id in url itself for all the requests an issue?
1
vote
3answers
249 views
is having a `set-cookie: sessionid=xxxxxxx` in every response considered bad practice?
My Django application sets a set-cookie: sessionid=xxxx; expires=Thu, 16-May-2019 18:54:59 (and some more, like max-age and path) on every response. The sessionid remains the same until the session ...
4
votes
1answer
67 views
Plausible scenario for a PHP session fixation attack with default settings?
Recently I was musing on the problem and realized that I cannot think of a plausible scenario for a session fixation attack against a PHP application running with default settings.
Given session....
-2
votes
1answer
71 views
Session key is the same throughout the session, can this behavior be exploited?
This application uses session key instead of CSRF token but this session key is the same throughout the session, it's not changing. It only changes if I logout and then login again to the application. ...
0
votes
0answers
37 views
Bind application user roles to JWT is good
I need implement service oriented application. so i hope to use micro services for my back end function and react for fronted end development.
for session management i hope to use JWT tokens. with ...
2
votes
1answer
130 views
How long a lifetime of a DTLS session with an IoT device should be?
I am using an application which is sending application data using MQTT-SN application Layer protocol. I have encrypted the UDP port using DTLS.
Now the question is if i have to reinitialize a ...
0
votes
1answer
90 views
How often should I reset my users' session cookies?
I am working on a Rails application where I reset the session upon logging out and each successful login, as well as when the user IP address changes.
Would resetting the session (changing the ...
0
votes
2answers
189 views
Could Someone Use a Stolen Cookie Session ID to Bypass Htaccess Login?
I'm doing some pen testing for my place of employment. I was able to grab the session id from the browser cookies, but i still cannot get past the htaccess login. I initially thought that by setting ...
1
vote
1answer
182 views
Store user credentials vs store refresh token
I am currently designing a native mobile application that require user authentication and authorization to connect to a REST API. Keycloak will be used as IAM tool and tokens will be JWT.
I don't ...
1
vote
1answer
207 views
Remember me feature: do we need a server side token if the cookie is signed by the server?
Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
0
votes
2answers
94 views
Cookie generation
What is the most secure was to generate cookies that makes it hard for a user to be able to guess the session cookie of another particular user or that will be accepted as a valid session cookie. ...
1
vote
1answer
87 views
Is a “logged_in” session flag secure enough?
Is the code below enough to secure a login area?
<?php
if ($_SESSION['logged_in']) {
// show content for logged-in users
}
Note: $_SESSION['logged_in'] is just a boolean value true after ...
2
votes
1answer
49 views
Does embedding (concatenating) a user ID in a session token for logging have any security implications?
Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that ...
0
votes
2answers
250 views
Why not write the CSRF Token into the Session
I am currently developing a web page and came across the OWASP Cheat sheet about double submit cookies. I am now thinking that's a good idea but I didn't get why you are not storing the CSRF token ...
0
votes
1answer
75 views
GDPR data minimisation session cookies
I have a research study being run. Participants are asked to;
Fill out a consent form (contains personal information as per GDPR)
Complete a questionnaire.
My hopes was that the questionnaire ...
0
votes
1answer
84 views
Can an attacker steal information from my HTTPS page by embedding it?
If a login page, secured with https/tls redirects to another site (also secured with https/tls) with a onetime use token (expires in a minute and has a nonce) in the querystring, can this token be ...
0
votes
2answers
272 views
Authenticated Sessions on a Desktop Application
I want to implement a login into my C++ desktop application and I'm having a hard time finding information on managing login sessions without cookies or JWT (JSON Web Token) (more on that in a bit). I ...
2
votes
2answers
198 views
How to implement secure user sessions using HttpOnly cookies?
I'm creating a web application, and want to allow users to log in (and stay logged in). My plan to support this in a secure way goes as follows:
User logs in from a login form - when successful, the ...
1
vote
2answers
75 views
Effects of new random Session token for each HTTP Request
On successful authentcation, a web application issues a session cookie that is a constant length string of apparently random hex characters.
...
1
vote
1answer
28 views
restoring logged out gmail session in running instance of chromium browser?
My situation is:
+I have created a special purpose gmail account
+I used a complicated password to protect the account. On purpose, I did not use any 2FA options are a "reset" email address or phone ...
1
vote
0answers
37 views
Rotating session names vs a static session name with a rotating validation string
I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
1
vote
1answer
110 views
Harden against privilege escalation in Microservices
Please consider the following scenario.
The system has a set of business owners (i.e. users of the system)
Each business owner is mapped to a set of customers
The business owners login to the system ...
2
votes
2answers
2k views
JWT or session cookie for API for both web and mobile app?
I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach.
The only two requirement are:
I need to know the users that are ...
0
votes
1answer
122 views
Handling race condition at the time of renewing the session
I've recently asked this question on SO. As the question was not answered yet, I've come up with an approach. But I wanted to check if there is not any security flaw in this solution.
Question
I had ...
0
votes
2answers
142 views
why MAC address can not be used as session identifier instead of session ID? [duplicate]
why MAC address can not be used as session identifier instead of session ID?
why the physical address (MAC address) cannot be used as a session identifier during the communications between servers ...
0
votes
1answer
233 views
A different CSRF token and session ID passed in the request [closed]
A CSRF token is what a server includes in its response, that is the same token which is passed in the request from the user.
In my case, a different CSRF token is getting included in the request- ...
1
vote
0answers
49 views
Generating session with id and password
Most web apps generate a long hex number and use it as a sessionid.
My idea is to create an ID which is auto-incrementing for each generated session and assign it a random secure string (a password). ...
1
vote
1answer
652 views
Should client have access to 3rd party API access token?
I'm trying to determine whether to use a Token provided by a Third Party service directly, OR issue my own custom Token and store the Third Party Token server side.
Authentication flow
User ...
1
vote
1answer
52 views
Should you remove the user's application PIN if they explicitly log out
I am looking for some security driven insight on when to dispose of a mobile application user's PIN in a few scenarios:
Background: When the user downloads and installs the mobile app, they are asked ...
0
votes
0answers
260 views
Multiple sshd sessions for single SSH login
I was grepping through /var/log/auth.log and noticed that for some reason, not every time, but sometimes when I would log in via SSH I would see entries like the following - where there were multiple ...
4
votes
2answers
832 views
Why we store session id instead of user id inside cookies?
Would not it be better to store user id instead of session id so that we only lookup database once for extracting other user info instead of twice extracting user id from session db then user db?
0
votes
1answer
106 views
How to implement machine tagging when allowing a user to “remember me” on web application? [duplicate]
The remember me cookie should identify the machine as well. So by implementing machine tagging, we will avoid a situation when an attacker tries to login with the user cookie from another machine. ...
0
votes
1answer
46 views
Best strategy to share some sensitive user data between Node and PHP
I am creating a website that is built on PHP. It has a small page where users can have a group chat and message each other. For that page I open a websocket with a help of socket.io and expressjs. I ...
1
vote
1answer
65 views
Security implications of using long lasting authentication cookies
I'm trying to find some information about potential security risks with allowing long lasting cookies for website authentication.
Initially it was set to not persist the login session, so it would ...
