We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
97
votes
8answers
11k views

Do we need to logout of webapps?

A quick Google search doesn't reveal whether it is important to logout of webapps (online banking, Amazon, Facebook, etc.), or if I am safe just closing the tab or browser. I am sure I heard on some ...
97
votes
3answers
148k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
48
votes
4answers
11k views

Why aren't sessions exclusive to an IP address?

Given the appropriate XSS vulnerability, an attacker can hijack somebody's session with the data that's passed to and from the server. Why aren't sessions always exclusive to the IP they were started ...
41
votes
4answers
29k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
39
votes
5answers
33k views

Why do you need to close your browser window after logging out of a website?

I might be wrong, but I believe the request to close the browser window after logging out is common, though it's completely unclear what the risks might be of failing to close a browser window (...
38
votes
3answers
27k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
37
votes
4answers
23k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
37
votes
1answer
6k views

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value. Example Suppose a user has the ...
28
votes
6answers
13k views

Can't a user change his session information to impersonate others?

Can't an attacker just change his/her session (or cookie because it's stored locally) information then fool the server that he's the legitimate user? Say for example, if a website uses the database ...
24
votes
4answers
34k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
23
votes
3answers
31k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
22
votes
4answers
18k views

Why users want to disable cookies?

I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
22
votes
5answers
3k views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
20
votes
2answers
2k views

Is there any point in setting the secure cookie flag for HSTS websites?

If my website has HSTS and forced HTTPS (i.e. user won't be able to access the plain HTTP version of the website), is there any point in setting secure: true for the cookies?
20
votes
3answers
9k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
19
votes
6answers
3k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
19
votes
5answers
1k views

Can you secure a web app from FireSheep without using SSL?

Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page. In this ...
17
votes
4answers
10k views

Session Hijacking - regenerate session ID

Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
17
votes
2answers
2k views

Does it make sense to hash a session id before passing it to an advertisement partner?

My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
16
votes
4answers
28k views

Is it safe to store password in HTML5 sessionStorage?

I am trying to improve the user experience on registration by not requiring the user to retype their password if validation on other fields fail. There are a few ways to implement this, example using ...
16
votes
3answers
3k views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
16
votes
2answers
32k views

OAuth access token vs session key

Is there any advantage to OAuth vs cookie-based sessions (established via username/password) under the following assumptions? There is only one legitimate client to the service The OAuth client ...
15
votes
3answers
9k views

How does FaceNiff work?

FaceNiff is an Android app that sniffs Facebook session ids. You must be connected to the same WiFi as the victim. It is said to be working even when WPA2 is present. How is it possible? I can decrypt ...
15
votes
2answers
11k views

Session Cookie Stealing Protection

I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used: HTTPS Everywhere Only use a securely created random ...
14
votes
6answers
3k views

How can a user defend against session hijacking?

Given a website with various security flaws, one of them is session hijacking, session token continuously being sent as an argument over unsecured HTTP. In my field it's not surprising that others ...
14
votes
2answers
19k views

How is the session ID sent securely?

I'm learning session management and I have two questions for which I could not find answers on the web. Once the user is authenticated, the server creates the Session ID and sends it to the client (...
13
votes
1answer
37k views

Web app with iframe and user - how to deal with session?

We have application which will be in iframe. Partner sites can use our application - put iframe in their sites. Partner site has users with money, who will use our application in iframe to buy items. ...
12
votes
3answers
5k views

Why doesn't Tornado have session

I've heard that cookies is less secure than the session. For example, if a web uses a cookie to detect if an user has logged in or not, people can forge a cookie to simulate a false user because he ...
12
votes
2answers
11k views

Is it possible to force a new SSL session

Using tools like Wireshark, it's possible to decrypt SSL traffic as the client by logging the (pre)master secret, without using a mitm attack or the server's private key. But I found that for some ...
12
votes
3answers
16k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
11
votes
5answers
5k views

What do the various browser “private modes” do?

Recently there has been some disagreement as to what "private mode" means when it comes to various browsers. Primarily I am referring to... IE's "InPrivate Browsing" Google Chrome's "Incognito Mode"...
11
votes
3answers
47k views

What typically is the expiration date of a session cookie?

I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
11
votes
1answer
3k views

What kind of hashing to use for storing REST API tokens in the database?

We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...
11
votes
2answers
25k views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
11
votes
1answer
972 views

Webapp2 security

I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and webapp2_extras....
10
votes
3answers
7k views

Session Hijacking through sessionId brute-forcing possible?

cookies usually contain a sessionId to keep track of a logged user. What would prevent a malicious user to forge millions of requests with random sessionIds and send them to a server, hoping to ...
10
votes
1answer
5k views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § 2.7 ...
9
votes
4answers
20k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
9
votes
5answers
2k views

Should a user have the ability to be logged in from multiple locations at the same time?

In the past, I've always used a single session per user setup, but I'm working on a project now where a user can be signed in from multiple locations/browsers at the same time. What are the security ...
9
votes
3answers
1k views

How do mobile apps maintain such long sessions while still being considered secure?

I opened my Amazon iOS app for the first time in several months today, and was able to go straight through checkout (where I was able to view and update my address) without being asked to re-auth. How ...
9
votes
2answers
10k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
8
votes
4answers
3k views

Using password hash as session ID?

For a rich client web app, on the server I need to verify that each call comes from a legally logged in user. Obviously user ID is not enough, because that's easy to guess. I have an idea I am ...
8
votes
4answers
2k views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
8
votes
2answers
10k views

Is it safe to store password in PHP session?

I need to do some encryptions in the private zone of my website and I want to bcrypt the user's password. Is it safe to store the password in the session when user does the login, so that I can use ...
8
votes
1answer
1k views

Security implications of not reusing SSL session in FTPS

I've just run into a problem with our FTPS server refusing connections due to missing SSL session reuse. Our client actually should reuse them, but it just doesn't work. I'm well aware that it's not ...
8
votes
4answers
1k views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...
8
votes
1answer
7k views

Will session_regenerate_id() without true parameter improves security? Should I use it right before login?

I want to decrease session fixation attack vulnerability, hence I used session_regenerate_id() before login. Somehow I'm in dark now and not sure the right answer for questions below: When we don't ...
8
votes
1answer
3k views

Ideal time for cookies to expire?

I get that websites that contain confidential personal information (e.g. banking system) have short sessions and expiration time for cookies for obviously reason. But what are the causes for sites, ...
8
votes
2answers
1k views

Modern, security-conscious, PHP book? [closed]

After creating a simple login system and trying to protect it against things like SQL injection, Session Hijacking, XSS, etc, I've found that I really enjoy doing this type of thing. I'd like to pick ...
8
votes
2answers
18k views

Best way to securely set a session cookie on another domain

We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com. The www site does not have an SSL certificate and is on a different domain. We have a login button on http://www.foo.co.uk ...