We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

43 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
3k views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
3
votes
0answers
89 views

How to group user actions within the same session?

I'm working on enterprise application where it's needed to audit all user actions (data modification, settings changing etc.) within their work session. What is the best way to group all that actions ...
2
votes
0answers
30 views

Can we use cookie session id value in the body of the request?

A tester mark this as a vulnerability in the web application that a session id is in the post request instead of cookie header.
2
votes
0answers
311 views

SAML 2 | Refresh IdP Session when user is working on SP

Wanted to discuss the solution and options to refresh the IdP Session when user is actively working on the SP. The use case is that after successful SP-Initiated SSO, there are two sessions in ...
2
votes
0answers
726 views

JWT as a nonce in sessionless backends

I'm creating an API server (a gateway) with two restrictions in mind: It has to be sessionless (no session id in a cookie or anywhere, no Redis or anything like that) I have to use an implicit grant ...
2
votes
0answers
115 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
2
votes
0answers
405 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
2
votes
1answer
51 views

Does embedding (concatenating) a user ID in a session token for logging have any security implications?

Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that ...
2
votes
2answers
3k views

JWT or session cookie for API for both web and mobile app?

I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach. The only two requirement are: I need to know the users that are ...
1
vote
0answers
111 views

Best way to let 2 servers communicate (with PHP) avoiding IP Spoofing?

Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP ...
1
vote
0answers
44 views

Configure Burp to pass dynamic authentication token from the past response to the next request in intruder

I would like to reuse an authentication token (which is dynamic) between a response and a request in Burp Suite intruder. By dynamic I mean that the token is invalidated after being sent to the ...
1
vote
1answer
302 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
1
vote
0answers
41 views

Rotating session names vs a static session name with a rotating validation string

I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
1
vote
0answers
51 views

Generating session with id and password

Most web apps generate a long hex number and use it as a sessionid. My idea is to create an ID which is auto-incrementing for each generated session and assign it a random secure string (a password). ...
1
vote
0answers
55 views

logout all devices or only one

I wonder which is the best practice in terms of security. Assuming an application where one can login from multiple devices in parallel what I should expect from "logout" button? To logout the user ...
1
vote
0answers
57 views

What are the security benefits of creating a session vs. just using Google ID token every time in my server back end?

I'm using Google Sign In to authenticate my users with my server back end via my Android app. So far I am able to sign in and obtain an ID token, which I then send to my server back end for ...
1
vote
0answers
222 views

Add to cart CSRF Token

I have CSRF tokens everywhere on my e-commerce site that use POST forms. However, I don't want to start a session (with a cookie) unless absolutely necessary (mainly because I'm using varnish cache, ...
1
vote
0answers
320 views

Can a CSRF token be used as a session identifier instead of a cookie?

Someone has asked the same question here: Should CSRF token without session cookie work? but the people answering seem uncertain. So, why does anyone need a cookie at all if they are using a token ...
1
vote
0answers
70 views

What is the most secure method for web session handling for multiple domain?

Based on the current standing of web security, what is the most secure / recommended method for web session handling: session cookies, cookie jars, web tokens, or anything else? The requirement is to ...
1
vote
1answer
722 views

SAML Without Session

Is there a way to implement SAML-based authentication to an IdP where the client keeps the session information? The idea is that a load-balanced server farm for the SP would be able to remain ...
1
vote
0answers
221 views

Passing Encryption Key Across Session for Symmetrically-Encrypted DB

I'm building a database that symmetrically encrypts user data. Nothing super sensitive, I'd use a third-party if it was. The data is encrypted with a surrogate key; the user must enter a password to ...
1
vote
0answers
2k views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
1
vote
0answers
1k views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
0
votes
0answers
14 views

CAS SSO not working when a secondary JSESSIONID is set by another app

I am using the CAS server overlay from https://apereo.github.io/cas/4.2.x/protocol/CAS-Protocol.html as SSO and hosting it on a WildFly AS, alongside a JSF application (referred as MyApp). The ...
0
votes
0answers
34 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...
0
votes
0answers
14 views

Intra-domain Session Management Using Cookie

I need some guidance on a solution I am building. I have a mega/super domain (e.g. .example.com). I need the users to be able to log into a subdomain (e.g. central.example.com) and maintain their ...
0
votes
0answers
28 views

Identity confirmation using PIN to decrypt previously issued token

I am building an app (for web and mobile) that requires a user pass two stages of authentication/authorisation in order to access a server-side API and subsequently use the app. First, they must ...
0
votes
1answer
91 views

Storing encrypted tokens in LocalStorage

I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service. The app ...
0
votes
0answers
42 views

gpg won't find public key if not in interactive session

How to make imported public key available after logging off? I have a Powershell process that encrypts the file (recipient was masked): Start-Process "gpg.exe" -ArgumentList "--batch --yes --always-...
0
votes
0answers
26 views

Can I rely on Google id_token for web session?

I'm building a website without a "server": JavaScript and AWS Lambdas as back-end through API Gateway. Knowing there is no solution for session when using lambdas, I was wondering if I could only use ...
0
votes
1answer
57 views

Is it a bad practice to send sensitive information(like a session id) in the aspx response?

Lets say I have an aspx login page which validates user credentials, obtains a session id and then redirects to the home page in the following way. login.aspx: var sessionId = ValidateCredentials(); ...
0
votes
2answers
133 views

What is the most secure way to store cross subdomain cookies

I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
0
votes
2answers
93 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
0
votes
0answers
38 views

Bind application user roles to JWT is good

I need implement service oriented application. so i hope to use micro services for my back end function and react for fronted end development. for session management i hope to use JWT tokens. with ...
0
votes
0answers
278 views

Multiple sshd sessions for single SSH login

I was grepping through /var/log/auth.log and noticed that for some reason, not every time, but sometimes when I would log in via SSH I would see entries like the following - where there were multiple ...
0
votes
0answers
354 views

Password-based client login over TCP/TLS

A client connects to a server through an application (not a web browser) with a long-running TCP connection. TLS is used, so the communication is secure. Is there a standard way to implement a ...
0
votes
0answers
493 views

Cookie issue on same server with different domain

I am using Zend framework 2 for my two applications (xyz.com and pqr.com) on the same server. I have a problem with cookie, when I logged in into xyz.com and edit the browser cookie settings using ...
0
votes
0answers
106 views

Protect unauthenticated interface from guessing attacks

I am currently encountering a publically available interface; accessible at least via web form/webviews and some stateless protocol (presumably REST). In the past this form allowed you to view your ...
0
votes
0answers
45 views

Cookies carrying Session identifiers

Is there a list of names for cookies carrying SID's? For instance: PHP by default uses PHPSESSIONID Tomcat uses JSESSIONID ... I would like to be able to intercepts all SID's supplied via Cookies, ...
0
votes
0answers
488 views

is Form Authentication more secure than using the session authentication?

Recently I have read about the form authentication of Asp.Net but I can discern no differences in the term of security between it and the session authentication. For Example if somebody hacked my ...
0
votes
0answers
1k views

session management and login php scripts

I want to to write login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. There are password protected control panels in abundance, ...
0
votes
1answer
265 views

Is this authentication scheme using JWT secure?

I was wondering if you could review this authentication scheme for web application. === Login Page === Credentials Verification => Server issues JWT => Stored in a Cookie JWT contains: exp: ...
-1
votes
1answer
69 views

Security mechanism for quick checkout (without cookies/session id)

I am implementing quick checkout in my e-store. Customer only have to enter email and phone number to make an order, system checks whether customer with such fields already registered, if not it ...