Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
0
votes
1answer
90 views

Security Considerations To Account for When Redirecting From Microservice to Another

I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
-1
votes
0answers
59 views

Why are cookies used to store session data for logins? [closed]

Any web browser I know of uses cookies to store (password related) session data ; clearing cookies means loosing that session data. I find it quite odd given that most cookies don't do anything with ...
1
vote
3answers
58 views

Current session cookie shown in a HTML page on request

A website exposes this function: https://test.com/getSessionCookie When an authenticated user clicks on it he gets an html page with his cookie. Could be this exploited in some ways?
0
votes
1answer
114 views

Is ProtonMail implemented a mechanism to prevent cookies stealing?

I want to check if I can steal my own ProtonMail cookies. I connect to my account, I delete the cookie named AUTH-x12334xxxaazzzrf6567788ddd (cookie name is randomized name). I refresh the page and as ...
1
vote
0answers
36 views

Is it bad practice to use only one token for a SPA (no applications, only user)?

Say we have multiple instances of application X deployed on site1.com, site2.com, site3.com, etc. And we have a centralized server at example.com serving all of these. All the instances of X are ...
18
votes
2answers
13k views

Session Cookie Stealing Protection

I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used: HTTPS Everywhere Only use a securely created random ...
1
vote
1answer
435 views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
1
vote
1answer
53 views

How to handle session absolute lifetime during user activity?

I'm implementing a web login system and am confused about how to think about when authenticated sessions (not just browser sessions) should be expired. There seem to be 2 factors: absolute lifetime ...
0
votes
2answers
700 views

Is it safe to store session state of different apps in single Redis cluster?

We have "web app as a service" offering. And right now each app has its Redis which stores session data. Is it secure if we use one redis cluster for all clients using this app. To be clear ...
1
vote
1answer
871 views

SAML Without Session

Is there a way to implement SAML-based authentication to an IdP where the client keeps the session information? The idea is that a load-balanced server farm for the SP would be able to remain ...
1
vote
1answer
101 views

What exactly are the session injection concerns when using Firebase Signin Links?

I'm guessing this applies to all implementations of sign-in links, but since I'm using Firebase I'd like to understand their concerns: https://firebase.google.com/docs/auth/web/email-link-auth#...
1
vote
1answer
96 views

Cookieless Authentication

I am working on an authentication server that can act as a central place to manage authentication for multiple projects, sort of like keycloak or ory kratos. While working on implementing ...
9
votes
4answers
2k views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
1
vote
2answers
3k views

If I am using a VPN with allowed multiple connections can each user/device be able to view traffic of the other user?

If I am using one a VPN Service, but it allows up to lets say 8 devices to connect, are all the devices/users able to view traffic from other users/devices? Or is each VPN connection creating its own ...
0
votes
1answer
68 views

How to securely store and use session IDs

I'm not sure what's the option to store and manage session IDs for long lived sessions (3-6 months each). Given that the session ID is generated with enough entropy and that the session ID is then ...
4
votes
2answers
3k views

Why would the session ID entropy only be half of the length of the session ID?

On this page on the OWASP website, there is a sentence about session id entropy I find quite strange: The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this ...
3
votes
2answers
56 views

Does limiting a web session to one browser window or tab provide added security?

A certain tax website has the frustrating feature of limiting the session to only one browser tab or window at a time. I haven't looked into how they might be doing this, but if you login on one tab, ...
1
vote
0answers
33 views

mORMot 1.18 doesn't invalidate session_signature after logout? is this the default behaviour?

On a website which uses mORMot 1.18 every request made by an authenticated user is in this format: ../search_items?session_signature=0000004C000F6DD02E24541C as reported within the framework docs ...
1
vote
1answer
57 views

What is the best way to go about generating a “token” for user authentication

Let's say I have a MySQL database with thousands of user accounts in it. These accounts contain lots of data, but for verification purposes, they each contain a username and a (hashed and salted) ...
0
votes
1answer
929 views

Storing encrypted tokens in LocalStorage

I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service. The app ...
0
votes
1answer
250 views

Encryption/decryption at client or server side with hybrid cryptosystem?

I've read a lot of documentations about encryption in the last weeks and I think I now have a good idea of what system I will use for my project (standard hybrid cryptosystem using RSA/AES). However, ...
1
vote
0answers
62 views

Change of domain without having to log in again

The question concerns the idea of transferring sessions between domains without having to log in again. I would like to do it like this: (user is logged in and changes the language to a language from ...
1
vote
1answer
78 views

How do I maintain/check a user session in the backend without having to use tokens?

I'm trying to login a user and, then, retrieve the user information like we do on a regular web app using php session. I have searched some solutions but I couldn't find any answer for my problem/...
3
votes
2answers
146 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
0
votes
2answers
78 views

is it safe to implement custom way of storing cookie in android?

i want to store session information in android application temporarily (as long as application is running). i am sending real-time data to node.js server from android client using Custom Protocol (...
1
vote
0answers
50 views

Can I use a persistent SID cookie for 'remember me'?

For the moment I implemented a login form asking for a username and a password and returning a session id (SID) that is stored in a cookie, without setting max_age or expires so that it will be ...
1
vote
1answer
67 views

Sessions With JWT

I'm currently implementing a REST Api for a Single Page Application and Mobile App. Any 3rd party login or grant access to them is not required. I've microservices behind a gateway (all HTTPS). My ...
0
votes
0answers
27 views

TLS Session Resumption for static content and JavaScript

This is an observation of SSL/TLS Resumption that maybe someone can help explain why SSL/TLS resumption is NOT shared between static assets and Javascript. Basically, I tested using two pages: pageA ...
8
votes
1answer
2k views

Security implications of not reusing SSL session in FTPS

I've just run into a problem with our FTPS server refusing connections due to missing SSL session reuse. Our client actually should reuse them, but it just doesn't work. I'm well aware that it's not ...
2
votes
2answers
970 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
1
vote
2answers
410 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
0
votes
0answers
47 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
1
vote
0answers
44 views

Can a sudo account access my browser sessions (e.g. Stack Exchange) remotely? [duplicate]

Suppose I am logged in to Stack Exchange on Firefox on my work computer. This session is clearly stored as a cookie (or something else), because it persists when I reboot the computer. I have sudo ...
41
votes
5answers
37k views

Why do you need to close your browser window after logging out of a website?

I might be wrong, but I believe the request to close the browser window after logging out is common, though it's completely unclear what the risks might be of failing to close a browser window (...
1
vote
3answers
8k views

How to scan a website using Nessus with login credentials

I have scanned my website using Nessus. But I need to scan it as a logged in user since most of the URLs are accessible only if we are logged in. How can I set website login credentials in Nessus?
0
votes
1answer
60 views

Logout on OIDC Provider Refresh Token validity in comparison to OAuth

I have an Relying Party that has obtained an Access Token and Refresh Token (as well as an ID Token) from an OpenID Provider (not an offline token). In all cases I have seen, the Refresh Token is ...
0
votes
0answers
44 views

Is there a good reason not to track valid JWTs in a key value store like redis?

I use Redis to track valid JWTs by saving the JTI (uuid-v4) mapped to the users id in Redis. If the JTI can not be found in Redis or the user id in Redis does not match the user id in the JWT the ...
2
votes
1answer
104 views

What else can be used instead of an API Key to protect resources in a REST API as is implied by OWASP?

I was reading the OWASP Cheat Sheet Series, specifically their cheat sheet for REST Security and one of the points they had under the section for API Keys was: Do not rely exclusively on API keys to ...
0
votes
0answers
42 views

Designing a user session API for both mobile and web clients

I'm currently working on a project. The apis on the backend will support both mobile and web clients. I'm attempting to design a user management flow for both clients and a bit confused about how to ...
0
votes
1answer
78 views

Is there non human risk related to idle sessions?

Let's say the OS is Windows or Linux As a System Admin, I think the answer to this question is : NO I always configure end users machine for auto lockout for a given idle session time. Because I'm ...
1
vote
1answer
62 views

If we're signing the id we send to the client, why not send the user id instead of session id?

I am learning about auth and session management, and using express-session in Node js. I am not able to find the need for this package. I read a about it online, but didn't get a satisfying answer. ...
1
vote
0answers
120 views

What's the latest thinking on website session expiry time? [closed]

Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
0
votes
0answers
57 views

Can python be used to retrieve a session ID to mimic logged in user at periodical times?

Let me quickly explain and then ask the question. I'm developing a Web Vulnerability assessment scanner for a project, and I'm learning python as I go, so forgive me if it might sound like a dumb ...
3
votes
1answer
90 views

Does a website's session key have to be unguessable if it's signed?

I'm creating (what I believe to be) a cryptographically hard to guess session key to keep my users logged in by generating 32 random bytes (using crypto.randomBytes). I'm storing this in a cookie (as ...
3
votes
0answers
120 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
0
votes
0answers
72 views

OpenId Connect Authorization Code Flow, using refresh token to renew id_token? And subsequently issueing a new cookie

I am currently working on implementing a proof of concept for ADFS (2019) (which I managed succesfully) and Azure AD with renewing the cookie / id_token by doing a refresh_token call in the backend of ...
1
vote
1answer
589 views

Using a persistent httpOnly cookie for authentication? (SPA)

So I'm building an application that needs authentication, I'm wondering if there's an security concerns with using a persistent httpOnly cookie to store user authentication with a SPA? (only 1 server. ...
2
votes
0answers
106 views

How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?

From PHP Session Management basics: Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may ...
1
vote
0answers
88 views

Explanation for maldetect advice

I received a notice from maldetect on an Apache machine I'm running, and I've not seen an advice like this before. I'd like to get a better understanding of exactly what I am looking at. I received ...
0
votes
0answers
102 views

What is the term for data leaking from one HTTP request to another and how to prevent it?

Context We recently added a feature that used a library whose API we misunderstood. Long story short, if user A sends a request to our web application, the library caches some result, and that result ...

1
2 3 4 5
11