We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
37
votes
1answer
6k views

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value. Example Suppose a user has the ...
19
votes
5answers
1k views

Can you secure a web app from FireSheep without using SSL?

Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page. In this ...
37
votes
4answers
23k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
15
votes
2answers
11k views

Session Cookie Stealing Protection

I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used: HTTPS Everywhere Only use a securely created random ...
8
votes
2answers
10k views

Is it safe to store password in PHP session?

I need to do some encryptions in the private zone of my website and I want to bcrypt the user's password. Is it safe to store the password in the session when user does the login, so that I can use ...
97
votes
3answers
148k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
41
votes
4answers
29k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
15
votes
3answers
9k views

How does FaceNiff work?

FaceNiff is an Android app that sniffs Facebook session ids. You must be connected to the same WiFi as the victim. It is said to be working even when WPA2 is present. How is it possible? I can decrypt ...
38
votes
3answers
27k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
20
votes
3answers
9k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
16
votes
3answers
3k views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
2
votes
1answer
5k views

Stopping Session Hijacking

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
9
votes
4answers
20k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
11
votes
1answer
3k views

What kind of hashing to use for storing REST API tokens in the database?

We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...
4
votes
3answers
3k views

How do I protect myself against 'hole 196'?

I came across this question a while ago and read about hole 196. Is there something I can install on my laptop to protect it against WPA2 Hole196? Software (such as Snort or DecaffeintID) can ...
4
votes
2answers
3k views

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...
2
votes
2answers
290 views

How to secure store sessions values in webapps?

EDIT: I changed the title of this post from "How to manage sessions in webapps?" to "How to secure store sessions values in webapps?" as it might have been misleading In the recent months I happened ...
1
vote
1answer
2k views

Using Random Numbers As Session variables

I am using randomly generated numbers as session variables to identify the sessions in a PHP application. To make further security proof what ways should I follow?
11
votes
5answers
5k views

What do the various browser “private modes” do?

Recently there has been some disagreement as to what "private mode" means when it comes to various browsers. Primarily I am referring to... IE's "InPrivate Browsing" Google Chrome's "Incognito Mode"...
4
votes
3answers
353 views

Does a session time out make an app more secure in a A+ HTTPS / random session key?

My main concern is not being a pain in the ass to my end-users. However, because 'banks' do it, some believe that session time-outs make an app more secure. But does it when your only mode of ...
3
votes
1answer
1k views

Signing (HMAC) cookie identifier

Related to this other question about sharing the secret to sign the cookies, my question is more trivial: how really secure is to sign a simple cookie identifier? In example, expressjs#session ...
97
votes
8answers
11k views

Do we need to logout of webapps?

A quick Google search doesn't reveal whether it is important to logout of webapps (online banking, Amazon, Facebook, etc.), or if I am safe just closing the tab or browser. I am sure I heard on some ...
28
votes
6answers
13k views

Can't a user change his session information to impersonate others?

Can't an attacker just change his/her session (or cookie because it's stored locally) information then fool the server that he's the legitimate user? Say for example, if a website uses the database ...
22
votes
5answers
3k views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
19
votes
6answers
3k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
17
votes
4answers
10k views

Session Hijacking - regenerate session ID

Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
24
votes
4answers
34k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
23
votes
3answers
31k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
4
votes
4answers
10k views

Is it correct to use form field(hidden) for storing Session Token

Is it correct to use form field(hidden) for storing Session Token instead of using Cookies? What is the security risk associated with it?
10
votes
1answer
5k views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § 2.7 ...
8
votes
2answers
1k views

Modern, security-conscious, PHP book? [closed]

After creating a simple login system and trying to protect it against things like SQL injection, Session Hijacking, XSS, etc, I've found that I really enjoy doing this type of thing. I'd like to pick ...
48
votes
4answers
11k views

Why aren't sessions exclusive to an IP address?

Given the appropriate XSS vulnerability, an attacker can hijack somebody's session with the data that's passed to and from the server. Why aren't sessions always exclusive to the IP they were started ...
6
votes
5answers
13k views

Why do banking websites always log you out after inactivity?

It seems that every single banking & financial website that I have used logs me out after a certain period of time. Are there a legal requirements or technical reasons for financial sites to do ...
11
votes
2answers
25k views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
6
votes
1answer
3k views

SSL/TLS Session Resumption with Session Tickets

We already have SSL session resumption enabled using a session cache. Based on an in-house performance report, enabling Session Resumption using Session Tickets is recommended. Is the performance ...
5
votes
1answer
2k views

Is this admin area secure enough? V2

This is a response to my previous question, Is this admin area secure enough?. There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
3
votes
2answers
2k views

Is my current method of handling session cookies insecure?

I'm writing a multi-tenant application where accounts are scoped by subdomains. This adds considerable complexity and I'm starting to worry about security. Each user can have several accounts. For ...
7
votes
2answers
2k views

Session cookie secure flag: best practice

There are 2 ways of setting 'secure' flag on a session cookie: In the application itself, for exemple: <session-config> <cookie-config> <http-only>true</http-only>...
6
votes
3answers
985 views

Vulnerabilities with DB backed session tokens

A user logs in and is given a session token. This token is also stored in a database on the server. The user includes this secret token with each request, and the server will pull it from the DB to ...
6
votes
1answer
4k views

MITM and replay attacks prevention

I have a client (a mobile app) and a server, the app connects to the server via SSL. The server uses a self-signed certificate, and the client has a file (I'm not entirely sure what, something to do ...
5
votes
2answers
80k views

SSL Handshake failed

I’m working on windows desktop application which is created using C++ (IDE : Qt creator). It has login panel, where i do user validation via https connection using openssl 1.0 library. Application is ...
5
votes
2answers
1k views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
4
votes
1answer
790 views

How to run multiple session while scanning application through Burp?

While scanning an application through Burp, I've found that if I use multiple threads, it results to session errors like The requested session id appears to be invalid. You may have more than one Task ...
4
votes
3answers
694 views

Is this admin area secure enough?

EDIT: Please view the revised question instead The admin area has special access to the database (modifying orders, etc). To help explain, I drew a diagram, so here is my process: Notes: I left ...
2
votes
1answer
1k views

Which approach to encrypting data on a per-user basis is more secure?

As a bit of a thought experiment, I've been thinking through how one might design a web application where a user's data (say, from a form on a webpage) is stored, encrypted, on the server, using a per-...
9
votes
5answers
2k views

Should a user have the ability to be logged in from multiple locations at the same time?

In the past, I've always used a single session per user setup, but I'm working on a project now where a user can be signed in from multiple locations/browsers at the same time. What are the security ...
5
votes
1answer
3k views

Signing session cookies

The Play Framework for Scala has support for signed session cookies. In the application configuration file is an "application secret" that is set as a secure random number when the application source ...
5
votes
3answers
2k views

Session fixation attack

Given the following conditions, Session ID does not change upon login Session ID travels in form of HTTP cookie There is no cross site scripting/redirection vulnerability on the login page is it ...
5
votes
4answers
2k views

How dangerous is storing the hashed password in local storage?

I'm looking at a web application that does something I find very unusual in the handling of login sessions. The application hashes the password with SHA256 and salt and saves it either in session ...
5
votes
3answers
298 views

Is my Google session safe when my computer is logged out or locked?

I've recently uploaded all the family photos to my Google Drive account. I have a strong password and 2 step verification enabled on my Google account. My home computer is (naturally) trusted and ...