Skip to main content

Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
40 votes
1 answer
8k views

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value. Example Suppose a user has the ...
makerofthings7's user avatar
19 votes
5 answers
1k views

Can you secure a web app from FireSheep without using SSL?

Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page. In this ...
Falkayn's user avatar
  • 292
127 votes
3 answers
178k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
Hoax's user avatar
  • 2,775
38 votes
4 answers
26k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
onlinespending's user avatar
18 votes
2 answers
14k views

Session Cookie Stealing Protection

I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used: HTTPS Everywhere Only use a securely created random ...
chotchki's user avatar
  • 487
17 votes
2 answers
47k views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
Salamander's user avatar
8 votes
2 answers
12k views

Is it safe to store password in PHP session?

I need to do some encryptions in the private zone of my website and I want to bcrypt the user's password. Is it safe to store the password in the session when user does the login, so that I can use ...
Surfer on the fall's user avatar
55 votes
3 answers
43k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
Angular noob's user avatar
42 votes
4 answers
32k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
Joony's user avatar
  • 521
15 votes
3 answers
10k views

How does FaceNiff work?

FaceNiff is an Android app that sniffs Facebook session ids. You must be connected to the same WiFi as the victim. It is said to be working even when WPA2 is present. How is it possible? I can decrypt ...
fhucho's user avatar
  • 245
4 votes
2 answers
651 views

How to secure store sessions values in webapps?

EDIT: I changed the title of this post from "How to manage sessions in webapps?" to "How to secure store sessions values in webapps?" as it might have been misleading In the recent months I happened ...
Federico's user avatar
  • 183
50 votes
4 answers
15k views

Why aren't sessions exclusive to an IP address?

Given the appropriate XSS vulnerability, an attacker can hijack somebody's session with the data that's passed to and from the server. Why aren't sessions always exclusive to the IP they were started ...
user avatar
26 votes
1 answer
12k views

What kind of hashing to use for storing REST API tokens in the database?

We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...
maniciam's user avatar
  • 363
22 votes
3 answers
11k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
makerofthings7's user avatar
19 votes
3 answers
5k views

Why do Firefox and Chrome "leak" critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
Stone True's user avatar
  • 2,052
14 votes
3 answers
23k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
Jarrod Everett's user avatar
11 votes
4 answers
28k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
IMB's user avatar
  • 2,978
11 votes
2 answers
9k views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
Kid Diamond's user avatar
11 votes
5 answers
6k views

What do the various browser "private modes" do?

Recently there has been some disagreement as to what "private mode" means when it comes to various browsers. Primarily I am referring to... IE's "InPrivate Browsing" Google Chrome's "Incognito Mode"...
chao-mu's user avatar
  • 2,821
9 votes
4 answers
5k views

With BREACH attack, is session-based CSRF token still secure?

This is something I haven't been able wrap my head around, if BREACH allow leaking of information, do we have to mask or generate CSRF token in a time-based or per-request fashion to make it more ...
bitinn's user avatar
  • 213
8 votes
4 answers
11k views

How dangerous is storing the hashed password in local storage?

I'm looking at a web application that does something I find very unusual in the handling of login sessions. The application hashes the password with SHA256 and salt and saves it either in session ...
user837487's user avatar
7 votes
2 answers
5k views

SSL/TLS Session Resumption with Session Tickets

We already have SSL session resumption enabled using a session cache. Based on an in-house performance report, enabling Session Resumption using Session Tickets is recommended. Is the performance ...
rudolfv's user avatar
  • 173
5 votes
1 answer
3k views

Signing (HMAC) cookie identifier

Related to this other question about sharing the secret to sign the cookies, my question is more trivial: how really secure is to sign a simple cookie identifier? In example, expressjs#session ...
lucasvc's user avatar
  • 153
5 votes
1 answer
5k views

Is session/cookie based authentication stateful or stateless?

Flask Web Development says The current login functionality implemented with the help of Flask-Login stores data in the user session, which Flask stores by default in a client-side cookie, so the ...
Tim's user avatar
  • 657
4 votes
3 answers
4k views

How do I protect myself against 'hole 196'?

I came across this question a while ago and read about hole 196. Is there something I can install on my laptop to protect it against WPA2 Hole196? Software (such as Snort or DecaffeintID) can ...
Karthik's user avatar
  • 2,324
4 votes
1 answer
3k views

Should client have access to 3rd party API access token?

I'm trying to determine whether to use a Token provided by a Third Party service directly, OR issue my own custom Token and store the Third Party Token server side. Authentication flow User ...
Z-Mehn's user avatar
  • 43
3 votes
1 answer
6k views

Stopping Session Hijacking

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session ...
SameOldNick's user avatar
1 vote
1 answer
3k views

Using Random Numbers As Session variables

I am using randomly generated numbers as session variables to identify the sessions in a PHP application. To make further security proof what ways should I follow?
Jayanta Kumar Nath's user avatar
97 votes
8 answers
13k views

Do we need to logout of webapps?

A quick Google search doesn't reveal whether it is important to logout of webapps (online banking, Amazon, Facebook, etc.), or if I am safe just closing the tab or browser. I am sure I heard on some ...
Angelo.Hannes's user avatar
33 votes
6 answers
21k views

Can't a user change his session information to impersonate others?

Can't an attacker just change his/her session (or cookie because it's stored locally) information then fool the server that he's the legitimate user? Say for example, if a website uses the database ...
mzcoxfde's user avatar
  • 605
27 votes
4 answers
38k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
Steve's user avatar
  • 469
25 votes
3 answers
35k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
FThompson's user avatar
  • 352
24 votes
5 answers
3k views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
James T's user avatar
  • 1,883
22 votes
3 answers
2k views

How do big websites (e.g. Google, Twitter, GitHub, ...) have practically infinite session lengths without compromising on security?

I'm currently implementing a login session system for a web application. I've read lots of articles recommending very low session and idle timeouts. For example OWASP says: Both the idle and absolute ...
Lukas Kalbertodt's user avatar
19 votes
6 answers
4k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
kzap's user avatar
  • 341
17 votes
2 answers
2k views

Does it make sense to hash a session id before passing it to an advertisement partner?

My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
user26315's user avatar
  • 173
17 votes
4 answers
12k views

Session Hijacking - regenerate session ID

Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
Purge's user avatar
  • 2,006
11 votes
1 answer
5k views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § 2.7 ...
40XUserNotFound's user avatar
10 votes
7 answers
24k views

Why do banking websites always log you out after inactivity?

It seems that every single banking & financial website that I have used logs me out after a certain period of time. Are there a legal requirements or technical reasons for financial sites to do ...
mkopala's user avatar
  • 227
9 votes
5 answers
3k views

Should a user have the ability to be logged in from multiple locations at the same time?

In the past, I've always used a single session per user setup, but I'm working on a project now where a user can be signed in from multiple locations/browsers at the same time. What are the security ...
VirtuosiMedia's user avatar
9 votes
2 answers
12k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
user15895's user avatar
8 votes
2 answers
7k views

Session cookie secure flag: best practice

There are 2 ways of setting 'secure' flag on a session cookie: In the application itself, for exemple: <session-config> <cookie-config> <http-only>true</http-only>...
Pleymor's user avatar
  • 217
8 votes
4 answers
13k views

How to use a stolen cookie?

I have taken advantage of an XSS vulnerability to steal a cookie by sending it as a variable in the URL to my php page. I think that is one of the normal processes. This is the XSS payload: <...
aDoN's user avatar
  • 293
8 votes
2 answers
1k views

Modern, security-conscious, PHP book? [closed]

After creating a simple login system and trying to protect it against things like SQL injection, Session Hijacking, XSS, etc, I've found that I really enjoy doing this type of thing. I'd like to pick ...
Mattiavelli's user avatar
7 votes
1 answer
8k views

Sending session cookie inside the HTTP response body

It's known that the secure practice of setting a session cookie is using Set-Cookie header with Secure and HttpOnly flags. But is there any security issues with sending cookie inside the HTTP response ...
ChildinTime's user avatar
7 votes
4 answers
5k views

Can a session be hijacked if the user is redirected from HTTPS to HTTP after login?

I am developing a web app, which makes HTTP calls as long as the user is not logged in. Once the user clicks the login button, he is sent to a "login page" that is HTTPS. The login makes an Ajax call ...
ccot's user avatar
  • 197
6 votes
1 answer
4k views

Signing session cookies

The Play Framework for Scala has support for signed session cookies. In the application configuration file is an "application secret" that is set as a secure random number when the application source ...
Ralph's user avatar
  • 275
6 votes
2 answers
6k views

Are PHP Sessions based on cookies or a cookie-IP pair?

I have a PHP website and my question is: If someone manages to steal my users' cookies via an XSS attack, is it enough for him to be identified as the user? Or does his IP also have to be the same as ...
fiftyeight's user avatar
6 votes
3 answers
6k views

Should I also hash my session id before storing it in the database? [duplicate]

I'm writing an API that hands out session id's using PHP's uniqid function (yes using more entropy). However I'm wondering if it adds more security to hash this id on the server, just like the ...
Thomas's user avatar
  • 163
6 votes
1 answer
5k views

MITM and replay attacks prevention

I have a client (a mobile app) and a server, the app connects to the server via SSL. The server uses a self-signed certificate, and the client has a file (I'm not entirely sure what, something to do ...
user avatar