Questions tagged [session-management]
Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user
572
questions
0
votes
1
answer
67
views
token leak by copying cookie
Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
0
votes
1
answer
86
views
Authentication that immune to cookie hijacking [duplicate]
There is a website that uses a cookie to store the user’s session info. Let's assume that a hacker steals a user’s cookie to gain unauthorized access to their online accounts via some vulnerability.
...
- 423
0
votes
0
answers
56
views
Prevent Session Hijacking with copying all metadata from a browser
For example, I'm signed in to my Gmail account. If I copy all data from all the places that Chrome uses (localstorage, all the cookies, all temp folders and so on) to another PC.
How does Google ...
- 423
0
votes
1
answer
188
views
Is there a problem with the use of HTTP cookies as auth tokens in mobile apps?
Imagine you have a website, for which you have configured a proper and secure session management / login system, using first-party / session cookies. Any interaction with that website is setup in the ...
- 131
0
votes
1
answer
150
views
TLS session ticket vs pre-shared key state management
TLS 1.2 session tickets are encrypted by the server with the session ticket encryption key (STEK). This key is shared with all the servers doing TLS termination. The session ticket contains all the ...
- 107
0
votes
2
answers
134
views
Why do we use Session ID cookies on the web instead of a unique device identifier?
Session IDs aren't exactly secure, you can copy them from one device to another just by copying the browser's temp files. Techniques to tell apart one device from another have existed in browsers for ...
- 1
1
vote
1
answer
56
views
Is Web session required for app security?
I understand that the idea of a session was conceived originally to improve user experience with Web applications. I also understand that session implementation can introduce attack vectors if not ...
- 436
0
votes
1
answer
341
views
Identifying a session hijacking attack [closed]
I understand session hijacking has been a widespread attack vector in the past months.
If an attacker steals a user’s session cookies, they can bypass 2FA and login/password.
If this is the case, how ...
- 3
0
votes
1
answer
118
views
What are the best practices to safely store OAuth2 tokens in a database?
I'm building a website with Patreon integration and I have identified the need to store Patreon user's OAuth2 token in the database. I'm wondering what's the best way to do that, security-wise. Some ...
- 1,030
0
votes
0
answers
75
views
What type of token is this?
I started noticing this kind of token in a lot of CTF tasks from different authors:
eyJlbWFpbCI6ImVtYWlsQG1haWxib3guZG9tYWluIiwiaWQiOjN9.ZLNCAQ.MxwKVKj_dramWyfT5XxT6g9U3xk
The structure is as follows:
...
- 3
2
votes
1
answer
230
views
Session Identifier: User-specific data in signed cookie vs Randomly generated session identifier
This question is inspired by looking at the functionality of the Flask-Login extension for the Python's Flask Framework (Web Framework).
This extension generates a session identifier using the user's ...
- 31
0
votes
2
answers
53
views
My logged in status is being maintained 36 hours after initial login on an online account
Log in time outs can be a pain we all know. However maintaining "logged in" status whereby even if I refresh a previously open tab the next day (I hibernate my laptop each night so Chrome ...
0
votes
2
answers
98
views
Security implications of using the current session to mint new access tokens
I saw a setup recently where frontend and resource servers were hosted on subdomains of the same second level domain. E.g. ui.example.com and api.example.com.
It had an interesting authentication flow ...
- 1
0
votes
1
answer
325
views
Session based CSRF Tokens - What value do i use with JWT?
The Double Submit Cookie CSRF Token pattern is a stateless technique that doesn't require storage or a database. However, it's vulnerable to session hijacking attacks and sub-/sibling domains that are ...
- 129
2
votes
1
answer
419
views
RDP logout necessary to prevent RDP session hijacking?
We recently got a strengthened security policy where people are required to log out of any RDP connections at the end of the day. So when I turn off my laptop, it is not enough to merely close the RDP ...
- 21
0
votes
2
answers
183
views
Protection against user session attacks (hijack, replay, tampering, CSRF, XSS...)
We develop a website in JAMStack, all URLs are static HTML page, and each interaction with the server are made by a fetch call on our REST API (micro-services).
When a user sign in, we want to ...
- 157
2
votes
1
answer
201
views
Logout is just clearing cookies [closed]
My friend who is a web developer implemented his session management in a totally new way for me.
He created a random sessionAPPID that is given to the user when he gives correct credentials.
He then ...
- 73
0
votes
1
answer
207
views
Google Security Cookies; Prevents cookie leak to malicious XHRs
Below is an excerpt from https://policies.google.com/technologies/cookies#security
The ‘pm_sess’, ‘YSC’ and ‘AEC’ cookies ensure that requests within a
browsing session are made by the user, and not ...
0
votes
0
answers
90
views
Is it worth replacing session based traditional auth with OpenID-Connect?
Details: traditional web-application with react frontend & nodejs API backend. FE & BE served on the same domain. FE -> example.com, API -> example.com/api
We have users and some of the ...
- 141
4
votes
1
answer
373
views
REST API authorization
Let say you have a REST API, which you want to use as the backend for React application. The application supports user login. You use JWT authorization to make that REST API stateless. Now the problem ...
- 43
2
votes
5
answers
2k
views
Session regeneration after password change?
So I understand the purpose of regenerating a session ID after a state change such as authenticating, i.e to prevent session fixation. What I'm not clear on is why this would be necessary after a ...
- 21
0
votes
0
answers
409
views
Oauth: Authorizing multiple clients at once
I have an application where the frontend app talks to 2 set of API servers: be1.domain.com and be2.domain.com
both these servers are independent entities (they do share the same top level domain, in ...
- 283
2
votes
0
answers
98
views
What would be the most complete procedure to get a simple login system working securely?
I don't have formal CS education but i've written one or 2 little websites. I have troubles communicating even in my native language but i hope this is understandable.
With simple i mean something ...
3
votes
1
answer
2k
views
Does Cache-Control: no-cache="Set-Cookie, Set-Cookie2" actually prevent caching cookies?
This OWASP recommendation says:
it is highly recommended to use the Cache-Control: no-cache="Set-Cookie, Set-Cookie2" directive, to allow web clients to cache everything except the session ...
- 103
0
votes
1
answer
158
views
Session cookie security
I am creating a small login system. It looks like the standard username/pwd and user can either log or register.
If they pass (authenticate), I create a session cookie that will be sent with the ...
- 25
2
votes
0
answers
809
views
Why do I have to store a refresh token in db
As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
- 21
2
votes
1
answer
210
views
use md5 hashed guid as app login and REST interface
We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest - api. All communication is over a secured https channel. The REST api is programmed to resist XSS ...
- 147
0
votes
1
answer
2k
views
Session ID not changed after logging in/ logging out
I am testing website security when I came across this:
When I enter the site URL, the user is given a session ID without any user input like:
7F746326038B30F51609423B2086BEBB
Scenario 1: Once I ...
- 7
0
votes
0
answers
502
views
Should other devices be required to login again after an email change in settings?
I have had multiple security researchers tell me that the best practice when a user changes their email in settings is to logout all other devices and force them to login again.
Nobody has been able ...
- 468
0
votes
1
answer
428
views
TLS session tickets between proxy and upstreams
I'm planning to implement (nginx) ssl_session_tickets in addition to ssl_session_cache between a proxy and upstream. They're not located in the same DC so TLS must be in place.
My questions are : 1) ...
- 103
0
votes
1
answer
197
views
Is passing an IDToken OK for seamless handover from app to website?
I am trying to assess the security implications for a session handover between an app and a website in the same company ecosystem.
The Setup
Mobile Application A and Website B use the same company ...
- 103
0
votes
0
answers
44
views
Should user session be restricted to a given IP? [duplicate]
If users are authentified with a sessionID (through cookies), would it increase security if we force users to log in again if for any reason their IP changed during their session?
Or is this not worth ...
- 101
2
votes
2
answers
463
views
Multiple user sessions at the same time in a backoffice
I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management.
The practice already has a backoffice-style software, but it's ...
user271185
2
votes
3
answers
796
views
Detecting session sharing with OAuth2
In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to ...
- 125
1
vote
1
answer
222
views
Is there a secure way of handling online payments without user accounts and logging in?
I'm creating a subscription-based desktop application, but there is no authentication on the platform as the "user" is the computer upon which the application is installed. This means no ...
- 11
1
vote
2
answers
165
views
How often to companies develop their own session management process?
I have been starting to read "The Application Hackers Handbook 2nd Edition" and just recently finished reading "Chapter 7: Attacking Session Management".
Do companies develop their ...
- 143
1
vote
1
answer
526
views
Why not use a long life session ID for auto-login instead of a persistent cookie with a token?
On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
- 11
18
votes
3
answers
1k
views
How do big websites (e.g. Google, Twitter, GitHub, ...) have practically infinite session lengths without compromising on security?
I'm currently implementing a login session system for a web application. I've read lots of articles recommending very low session and idle timeouts. For example OWASP says:
Both the idle and absolute ...
- 343
12
votes
1
answer
3k
views
Is this a right technique to create and validate session tokens?
Current token format, creation, verification:
vls_k3uGjFsDfA49Ygt8mqNHAtkBuUqRTU6K1KfUCwEiX9Z
I am creating session token as follows:
Create an array of 32 bytes.
Fill the first 28 bytes via PRNG.
...
- 123
3
votes
3
answers
997
views
Hashing sessions and retrieving them using cookie(s) with session "id" and "token"
I'm implementing custom authentication & session management system in Node.js & PostgreSQL. My goal is to implement sessions that expire after 2 weeks (if not refreshed/renewed).
OWASP and ...
0
votes
1
answer
2k
views
Logout functionality with JWT Session tokens
As per my understanding, JWTs are signed tokens which can be used to identify users, if used as session tokens, they can eliminate need to store session on server ie. they are stateless.
Suppose I ...
-1
votes
1
answer
125
views
Source of strange sessions
I stumbled upon some strange entries in our PHP sessions, they look like this:
PHPREDIS_SESSION:${9923XXXXX+99XXXXXX} (<- I have changed some digits to 'X')
PHPREDIS_SESSION:http://hitbXXXXXXXXXXX....
- 99
1
vote
2
answers
191
views
Protecting against cookie/session re-use with a sequence generator
I might be completely making this up as a solution or even feasible.
I have a situation where a cookie exists for a browser/user/tab. In the background, while the user is viewing a page a request is ...
- 161
3
votes
2
answers
2k
views
Is the Guid.NewGuid method in .NET secure enough to be a session id?
At the company I work at, we use the output of the Guid.NewGuid method as a session id. So when a customer logs into our website, the output of Guid.NewGuid becomes the customer's session id and is ...
- 45
4
votes
2
answers
2k
views
Do I still need a CSRF token?
When a client makes the first request, I send a session ID cookie generated by the server as a string of 64 random bytes using getrandom(2) or /dev/urandom, stored in the database, with the flags ...
- 329
0
votes
1
answer
146
views
Am I writing a good login system? [closed]
I am designing a login system for my React app.
All user data must be protected in case of a db leak. I only store encrypted data, with the exception of the email.
To encrypt I need a key and I don't ...
- 103
1
vote
1
answer
1k
views
How do you make sure a session token is expired when a browser might use "session restore"
I was reading this article about session tokens from Mozilla's Developer website. Historically, I've always assumed that a session token set with a blank expiry (or one set to zero) would expire at ...
- 41
1
vote
1
answer
431
views
When generating user session tokens, should i bother checking for a duplicate?
In a program i am writing, i use session authentication tokens that we give back to a user to have them hand in with their requests.
This is working very well but this question is about the generated ...
- 125
2
votes
3
answers
1k
views
Is a simple random+hmac session cookie breakable?
I make session cookies of form session_id+'|'+hmac_sha256(session_id, static_secret) where session_id = random_string(16 bytes) made with a PRNG (not a CSPRNG!) seeded on the server's timestamp at ...
- 123
1
vote
2
answers
3k
views
Storing Session Id in application logs
Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId?
...
- 113