Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
3 votes
2 answers
2k views

Is the Guid.NewGuid method in .NET secure enough to be a session id?

At the company I work at, we use the output of the Guid.NewGuid method as a session id. So when a customer logs into our website, the output of Guid.NewGuid becomes the customer's session id and is ...
Weare Mwam's user avatar
4 votes
2 answers
2k views

Do I still need a CSRF token?

When a client makes the first request, I send a session ID cookie generated by the server as a string of 64 random bytes using getrandom(2) or /dev/urandom, stored in the database, with the flags ...
rid's user avatar
  • 329
0 votes
1 answer
163 views

Am I writing a good login system? [closed]

I am designing a login system for my React app. All user data must be protected in case of a db leak. I only store encrypted data, with the exception of the email. To encrypt I need a key and I don't ...
Kewyn Vieira's user avatar
1 vote
1 answer
2k views

How do you make sure a session token is expired when a browser might use "session restore"

I was reading this article about session tokens from Mozilla's Developer website. Historically, I've always assumed that a session token set with a blank expiry (or one set to zero) would expire at ...
Brewer's user avatar
  • 41
1 vote
1 answer
532 views

When generating user session tokens, should i bother checking for a duplicate?

In a program i am writing, i use session authentication tokens that we give back to a user to have them hand in with their requests. This is working very well but this question is about the generated ...
Necro's user avatar
  • 125
2 votes
3 answers
1k views

Is a simple random+hmac session cookie breakable?

I make session cookies of form session_id+'|'+hmac_sha256(session_id, static_secret) where session_id = random_string(16 bytes) made with a PRNG (not a CSPRNG!) seeded on the server's timestamp at ...
capr's user avatar
  • 123
1 vote
2 answers
3k views

Storing Session Id in application logs

Short version: Is it not recommended to store sessionId in log files/database in plaintext (considering it may put active sessions at risk)? If yes, why do I see many queries on how to log sessionId? ...
ramtech's user avatar
  • 113
1 vote
0 answers
216 views

Is it bad practice to use only one token for a SPA (no applications, only user)?

Say we have multiple instances of application X deployed on site1.com, site2.com, site3.com, etc. And we have a centralized server at example.com serving all of these. All the instances of X are ...
Saunved Mutalik's user avatar
0 votes
1 answer
496 views

Is ProtonMail implemented a mechanism to prevent cookies stealing?

I want to check if I can steal my own ProtonMail cookies. I connect to my account, I delete the cookie named AUTH-x12334xxxaazzzrf6567788ddd (cookie name is randomized name). I refresh the page and as ...
Anonymous's user avatar
  • 274
1 vote
3 answers
198 views

Current session cookie shown in a HTML page on request

A website exposes this function: https://test.com/getSessionCookie When an authenticated user clicks on it he gets an html page with his cookie. Could be this exploited in some ways?
Maicake's user avatar
  • 567
1 vote
1 answer
247 views

What exactly are the session injection concerns when using Firebase Signin Links?

I'm guessing this applies to all implementations of sign-in links, but since I'm using Firebase I'd like to understand their concerns: https://firebase.google.com/docs/auth/web/email-link-auth#...
ldiqual's user avatar
  • 13
1 vote
1 answer
454 views

How to handle session absolute lifetime during user activity?

I'm implementing a web login system and am confused about how to think about when authenticated sessions (not just browser sessions) should be expired. There seem to be 2 factors: absolute lifetime ...
Andy Stewart's user avatar
3 votes
2 answers
840 views

Does limiting a web session to one browser window or tab provide added security?

A certain tax website has the frustrating feature of limiting the session to only one browser tab or window at a time. I haven't looked into how they might be doing this, but if you login on one tab, ...
Luke's user avatar
  • 131
2 votes
1 answer
1k views

Cookieless Authentication

I am working on an authentication server that can act as a central place to manage authentication for multiple projects, sort of like keycloak or ory kratos. While working on implementing ...
fragile_frogs's user avatar
1 vote
0 answers
129 views

mORMot 1.18 doesn't invalidate session_signature after logout? is this the default behaviour?

On a website which uses mORMot 1.18 every request made by an authenticated user is in this format: ../search_items?session_signature=0000004C000F6DD02E24541C as reported within the framework docs ...
Maicake's user avatar
  • 567
1 vote
1 answer
1k views

What is the best way to go about generating a “token” for user authentication

Let's say I have a MySQL database with thousands of user accounts in it. These accounts contain lots of data, but for verification purposes, they each contain a username and a (hashed and salted) ...
OOPS Studio's user avatar
1 vote
1 answer
3k views

Encryption/decryption at client or server side with hybrid cryptosystem?

I've read a lot of documentations about encryption in the last weeks and I think I now have a good idea of what system I will use for my project (standard hybrid cryptosystem using RSA/AES). However, ...
Mister_Ideas's user avatar
1 vote
2 answers
4k views

How to securely store and use session IDs

I'm not sure what's the option to store and manage session IDs for long lived sessions (3-6 months each). Given that the session ID is generated with enough entropy and that the session ID is then ...
Shoe Diamente's user avatar
1 vote
0 answers
126 views

Change of domain without having to log in again

The question concerns the idea of transferring sessions between domains without having to log in again. I would like to do it like this: (user is logged in and changes the language to a language from ...
A.Sobolev's user avatar
1 vote
1 answer
2k views

How do I maintain/check a user session in the backend without having to use tokens?

I'm trying to login a user and, then, retrieve the user information like we do on a regular web app using php session. I have searched some solutions but I couldn't find any answer for my problem/...
Thiago G's user avatar
1 vote
0 answers
378 views

Can I use a persistent SID cookie for 'remember me'?

For the moment I implemented a login form asking for a username and a password and returning a session id (SID) that is stored in a cookie, without setting max_age or expires so that it will be ...
gruvw's user avatar
  • 131
0 votes
0 answers
158 views

TLS Session Resumption for static content and JavaScript

This is an observation of SSL/TLS Resumption that maybe someone can help explain why SSL/TLS resumption is NOT shared between static assets and Javascript. Basically, I tested using two pages: pageA ...
Fifi Gaia's user avatar
0 votes
0 answers
103 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
Eliter's user avatar
  • 49
1 vote
0 answers
114 views

Can a sudo account access my browser sessions (e.g. Stack Exchange) remotely? [duplicate]

Suppose I am logged in to Stack Exchange on Firefox on my work computer. This session is clearly stored as a cookie (or something else), because it persists when I reboot the computer. I have sudo ...
wimi's user avatar
  • 151
0 votes
1 answer
7k views

Is it possible to bypass httponly?

I read some articles about XSS and how to mitigate the flaws in a web application. I've seen the HttpOnly on Set-Cookie. Can this flag be bypassed? Or is there another way to access a session cookie? ...
human_garbage's user avatar
2 votes
1 answer
742 views

Logout on OIDC Provider Refresh Token validity in comparison to OAuth

I have an Relying Party that has obtained an Access Token and Refresh Token (as well as an ID Token) from an OpenID Provider (not an offline token). In all cases I have seen, the Refresh Token is ...
BenjaminH's user avatar
  • 562
0 votes
0 answers
283 views

Is there a good reason not to track valid JWTs in a key value store like redis?

I use Redis to track valid JWTs by saving the JTI (uuid-v4) mapped to the users id in Redis. If the JTI can not be found in Redis or the user id in Redis does not match the user id in the JWT the ...
MADforFUNandHappy's user avatar
3 votes
1 answer
1k views

What else can be used instead of an API Key to protect resources in a REST API as is implied by OWASP?

I was reading the OWASP Cheat Sheet Series, specifically their cheat sheet for REST Security and one of the points they had under the section for API Keys was: Do not rely exclusively on API keys to ...
Script47's user avatar
  • 227
0 votes
0 answers
889 views

Designing a user session API for both mobile and web clients

I'm currently working on a project. The apis on the backend will support both mobile and web clients. I'm attempting to design a user management flow for both clients and a bit confused about how to ...
EI-01's user avatar
  • 101
1 vote
1 answer
315 views

If we're signing the id we send to the client, why not send the user id instead of session id?

I am learning about auth and session management, and using express-session in Node js. I am not able to find the need for this package. I read a about it online, but didn't get a satisfying answer. ...
Satvik Nema's user avatar
3 votes
0 answers
2k views

What's the latest thinking on website session expiry time? [closed]

Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
Robin Winslow's user avatar
0 votes
0 answers
156 views

Can python be used to retrieve a session ID to mimic logged in user at periodical times?

Let me quickly explain and then ask the question. I'm developing a Web Vulnerability assessment scanner for a project, and I'm learning python as I go, so forgive me if it might sound like a dumb ...
Adeel Ahmed's user avatar
0 votes
1 answer
201 views

Is there non human risk related to idle sessions?

Let's say the OS is Windows or Linux As a System Admin, I think the answer to this question is : NO I always configure end users machine for auto lockout for a given idle session time. Because I'm ...
steven miller's user avatar
2 votes
1 answer
200 views

Does a website's session key have to be unguessable if it's signed?

I'm creating (what I believe to be) a cryptographically hard to guess session key to keep my users logged in by generating 32 random bytes (using crypto.randomBytes). I'm storing this in a cookie (as ...
mpen's user avatar
  • 121
3 votes
0 answers
1k views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
alloy's user avatar
  • 131
1 vote
1 answer
244 views

Sessions With JWT

I'm currently implementing a REST Api for a Single Page Application and Mobile App. Any 3rd party login or grant access to them is not required. I've microservices behind a gateway (all HTTPS). My ...
Regyn's user avatar
  • 111
4 votes
0 answers
324 views

How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?

From PHP Session Management basics: Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may ...
Kyoma's user avatar
  • 141
1 vote
0 answers
337 views

Explanation for maldetect advice

I received a notice from maldetect on an Apache machine I'm running, and I've not seen an advice like this before. I'd like to get a better understanding of exactly what I am looking at. I received ...
davidgo's user avatar
  • 611
0 votes
0 answers
333 views

What is the term for data leaking from one HTTP request to another and how to prevent it?

Context We recently added a feature that used a library whose API we misunderstood. Long story short, if user A sends a request to our web application, the library caches some result, and that result ...
user1202136's user avatar
0 votes
0 answers
1k views

Simplest secure way to create session cookies

Background: I've been using a simple session cookie design for my web app. I have a users table, and a sessions table that basically looks like this: id | user_id | visited_at -----+---------+-------...
Zizheng Tai's user avatar
0 votes
2 answers
2k views

Is it safe to store session state of different apps in single Redis cluster?

We have "web app as a service" offering. And right now each app has its Redis which stores session data. Is it secure if we use one redis cluster for all clients using this app. To be clear ...
titus's user avatar
  • 111
3 votes
0 answers
400 views

Should you terminate a session when an incorrect CSRF token is submitted?

According to the OWASP CSRF Prevention Guide if the server fails to ...verify the existence and validity of the token in the request compared to the token found in the user session ... then the ...
Quebec's user avatar
  • 31
4 votes
4 answers
4k views

Passing plain text password over HTTPS

My login for POST is over HTTPS. Therefore, I don't do anything to the provided password before submitting. And I don't see an issue there unless someone is watching your browser's developer console. (...
Nipun Thathsara's user avatar
-2 votes
2 answers
377 views

This client doesn't verify which representation it requested, while expecting a specific one. What are the security implications? [closed]

I am currently investigating a mobile app API. There is a feature which fills in a form in the app automatically. The user supplies a string which contains all the compressed form data. And then the ...
Martin Fürholz's user avatar
0 votes
1 answer
421 views

Are encrypted cookies over http safe? [duplicate]

I am new to cookies. My understanding of encrypted cookies is that a server can store info. at client side without the client knowing about its contents. Now, let us say a server generates ...
Abhishek Palakkal Kaliyath's user avatar
6 votes
2 answers
6k views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
ZeroNullByte's user avatar
0 votes
1 answer
1k views

Same session cookies for a user logging from different browser/machine

I am new to web application security and have a few doubts regarding session cookies. Which of these is considered more vulnerable: Having the same session cookies for a user logging in from ...
vish's user avatar
  • 1
2 votes
2 answers
2k views

What attacks are httpOnly cookies intended to prevent?

I know that HttpOnly attribute restricts the cookie from being accessed by JavaScript etc. Is there any specific attacks regarding this issue? Can cookie theft and hijacking be counted as attacks ...
Fragrance's user avatar
1 vote
1 answer
1k views

What are the security risks of storing user roles/types in a cookie?

Recently I had to use a website which stored things like user role (user or admin) in a cookie. When I modified the username the displayed username changed in the website. I immediately asked the ...
Sjoerd Brauer's user avatar
1 vote
0 answers
336 views

Are JWT still not recommended for sessions?

It seems there is a large divide as to wether or not you should have JWT or Session ID for managing user session on WebApp/API (for a web front end or/and a mobile app). It seems that the consensus ...
user7952151's user avatar

1
2
3 4 5
12