We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
0
votes
1answer
48 views

Backend Authentication of Mobile App: Session ID vs. OAuth

Currently I am developing an iOS/Android app and a corresponding backend in PHP. In the last days I read a lot about user authentication and now I am a bit confused. For now I am using a session ID ...
0
votes
0answers
14 views

CAS SSO not working when a secondary JSESSIONID is set by another app

I am using the CAS server overlay from https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol.html as SSO and hosting it on a WildFly AS, alongside a JSF application (referred as MyApp). The ...
1
vote
0answers
110 views

Best way to let 2 servers communicate (with PHP) avoiding IP Spoofing?

Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP ...
0
votes
0answers
34 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...
7
votes
4answers
3k views

On password change in a web application, should it log out all other sessions?

When a user is logged into a web-based application in multiple tabs, and changes their password, should it automatically log them out of the other tabs? The use case is an account is compromised, the ...
0
votes
1answer
89 views

Storing encrypted tokens in LocalStorage

I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service. The app ...
97
votes
3answers
148k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
2
votes
1answer
92 views

Security Risk of Stolen Session ID vs Authentication Token

I was intrigued by the discussion of this SO question as well as the accompanying blog post. I'm trying to better understand the mechanics of the two systems, and one of the questions I came up with ...
19
votes
6answers
3k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
1
vote
0answers
43 views

Cannot remove an unknown active session from my Facebook account [closed]

Cannot remove an unknown active session from my Facebook account . My Facebook account was hacked and I changed my password, then i deleted my active sessions. There was one session from MI that it ...
0
votes
0answers
14 views

Intra-domain Session Management Using Cookie

I need some guidance on a solution I am building. I have a mega/super domain (e.g. .example.com). I need the users to be able to log into a subdomain (e.g. central.example.com) and maintain their ...
0
votes
0answers
27 views

Identity confirmation using PIN to decrypt previously issued token

I am building an app (for web and mobile) that requires a user pass two stages of authentication/authorisation in order to access a server-side API and subsequently use the app. First, they must ...
1
vote
1answer
48 views

Is an index, nonce and HMAC good enough for session management?

The scope is server-side session management with session payloads being sent to the client in a cookie. I'm researching session management for web applications. I've been looking at a couple places, ...
2
votes
1answer
65 views

2FA/MFA and Session management

Background Recently observed researchers reporting bugs related to a situation where a website would not invalidate secondary (separate) active session once 2FA/MFA has been enabled in primary ...
2
votes
3answers
614 views

is having a `set-cookie: sessionid=xxxxxxx` in every response considered bad practice?

My Django application sets a set-cookie: sessionid=xxxx; expires=Thu, 16-May-2019 18:54:59 (and some more, like max-age and path) on every response. The sessionid remains the same until the session ...
0
votes
2answers
93 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
0
votes
0answers
42 views

gpg won't find public key if not in interactive session

How to make imported public key available after logging off? I have a Powershell process that encrypts the file (recipient was masked): Start-Process "gpg.exe" -ArgumentList "--batch --yes --always-...
2
votes
5answers
3k views

How do cookie and session implement for preventing reuse elsewhere

I have some scenarios: A cookie is generated on Chrome and will be used in Firefox in the same machine. A cookie is generated on Chrome and will be used in Chrome on a different machine. A cookie is ...
2
votes
0answers
30 views

Can we use cookie session id value in the body of the request?

A tester mark this as a vulnerability in the web application that a session id is in the post request instead of cookie header.
1
vote
2answers
53 views

Serverless Apps Authenticate Users After Page Load - Flaw?

Server-based apps check for a session cookie before returning any content to the user. If an authentication cookie isn't sent from the user's browser, the only content delivered to the user is a ...
2
votes
1answer
139 views

How often should I reset my users' session cookies?

I am working on a Rails application where I reset the session upon logging out and each successful login, as well as when the user IP address changes. Would resetting the session (changing the ...
6
votes
4answers
7k views

How to use a stolen cookie?

I have taken advantage of an XSS vulnerability to steal a cookie by sending it as a variable in the URL to my php page. I think that is one of the normal processes. This is the XSS payload: <...
1
vote
1answer
299 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
1
vote
1answer
722 views

SAML Without Session

Is there a way to implement SAML-based authentication to an IdP where the client keeps the session information? The idea is that a load-balanced server farm for the SP would be able to remain ...
0
votes
2answers
76 views

Is a web app vulnerable if it only uses session token in cookie to authenticate a user

I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability. The ...
0
votes
0answers
26 views

Can I rely on Google id_token for web session?

I'm building a website without a "server": JavaScript and AWS Lambdas as back-end through API Gateway. Knowing there is no solution for session when using lambdas, I was wondering if I could only use ...
2
votes
3answers
61 views

Is it advisable to tie different capabilities to different session tokens?

Let's say you're creating a banking web application with mobile apps. A bank user has permissions "transfer money" and "view balances." When a user logs in, we can create a session token (typical ...
0
votes
2answers
1k views

Testing Session Fixation when cookie is unchanged

I was testing a web application where cookies (session ID, session values) are the same for all times. Even after successful authentication takes place it remains unchanged. The session ID travels in ...
0
votes
1answer
79 views

GDPR data minimisation session cookies

I have a research study being run. Participants are asked to; Fill out a consent form (contains personal information as per GDPR) Complete a questionnaire. My hopes was that the questionnaire ...
2
votes
2answers
3k views

JWT or session cookie for API for both web and mobile app?

I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach. The only two requirement are: I need to know the users that are ...
0
votes
1answer
57 views

Is it a bad practice to send sensitive information(like a session id) in the aspx response?

Lets say I have an aspx login page which validates user credentials, obtains a session id and then redirects to the home page in the following way. login.aspx: var sessionId = ValidateCredentials(); ...
0
votes
2answers
131 views

What is the most secure way to store cross subdomain cookies

I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
5
votes
2answers
1k views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
2
votes
1answer
131 views

Is there any benefit to using a salt when the cleartext is random data?

I understand that using a salt makes it harder to find cleartext using rainbow tables - but in that scenario the clear text is structured / low entropy. If my clear text is generated randomly, then is ...
39
votes
5answers
33k views

Why do you need to close your browser window after logging out of a website?

I might be wrong, but I believe the request to close the browser window after logging out is common, though it's completely unclear what the risks might be of failing to close a browser window (...
2
votes
1answer
97 views

Firefox 68 — any changes affecting CSRF capabilities?

My Ubuntu 18 system did an upgrade to Firefox 68 (presumably from 67.x). I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid ...
1
vote
0answers
44 views

Configure Burp to pass dynamic authentication token from the past response to the next request in intruder

I would like to reuse an authentication token (which is dynamic) between a response and a request in Burp Suite intruder. By dynamic I mean that the token is invalidated after being sent to the ...
1
vote
1answer
110 views

Why sign session cookies? [duplicate]

I'm using express-session middleware to store sessions on the server. The client's browser gets a cookie with the session ID. A secret is required in the configuration; it is used to sign the session ...
2
votes
3answers
600 views

Why are ASP.NET form authentication cookies deleted only on client side if client side can't be trusted?

ASP.NET documentation says: FormsAuthentication.SignOut() Removes the forms-authentication ticket from the browser Why is the cookie not invalidated at the server as well? It would be easy ...
1
vote
1answer
63 views

Is it recommended to send an authentication request to the Resource Owner (by the Authorization Server) if it already has an active session?

In OAuth 2.0 Authorization Code Flow (Grant Type), is it recommended (or is it maybe even a best practice) to send an authentication request (e.g. a login-request form) to the Resource Owner (by the ...
0
votes
2answers
69 views

Are JWT's the way to go in my situation?

I am working on a personal project for learning reasons, and have come to the point of authenticating and authorizing users. I would like to keep the project as stateless as possible, to make sure it ...
0
votes
1answer
41 views

Cancelling a request stops new authentication cookie getting to browser, invalidating all further requests

I am trying to secure my login system using authentication cookies. If the user tries to access a protected resource they must provide an authentication cookie. If the cookie is valid, the request is ...
0
votes
2answers
88 views

Is there another way than session hijacking to access user account through XSS?

If I have discovered an XSS vulnerability, is there another way of gaining access to an account without session hijacking? Mainly because on most of the sites I test, the HttpOnly and Secure flags are ...
3
votes
1answer
3k views

How to secure MySQL based web session data table?

I have the following MySQL session schema: CREATE TABLE `SessionData` ( `id` varchar(50) COLLATE utf8_unicode_ci NOT NULL, `data` text COLLATE utf8_unicode_ci, `date` datetime DEFAULT NULL, ...
2
votes
1answer
276 views

How could ASP.NET forms authentication session leak into a different site?

We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site. I can't figure out how is IIS or ASP.NET allowing this to occur Steps: Login to ...
0
votes
1answer
108 views
2
votes
1answer
156 views

How long a lifetime of a DTLS session with an IoT device should be?

I am using an application which is sending application data using MQTT-SN application Layer protocol. I have encrypted the UDP port using DTLS. Now the question is if i have to reinitialize a ...
4
votes
1answer
80 views

Plausible scenario for a PHP session fixation attack with default settings?

Recently I was musing on the problem and realized that I cannot think of a plausible scenario for a session fixation attack against a PHP application running with default settings. Given session....
1
vote
1answer
115 views

Harden against privilege escalation in Microservices

Please consider the following scenario. The system has a set of business owners (i.e. users of the system) Each business owner is mapped to a set of customers The business owners login to the system ...
6
votes
4answers
4k views

prevent session hijacking in PHP

I wrote the log In/log Out scripts of my web page and when the user logs in I store in the $_SESSION variable the user agent. Now each time a page is loaded I check if the user is logged in or not and ...