Skip to main content

Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
5 votes
1 answer
113 views

Do browsers like FireFox, Chrome, Opera, and Tor store TLS 1.3 session tickets on the disk?

Do browsers save TLS 1.3 session tickets on the disk to resume a TLS session after the browser process has been killed and restarted? Are there any glaring security risks of caching TLS 1.3 session ...
vibhav950's user avatar
1 vote
1 answer
43 views

Besides checking whether the session ID is valid, what other things should we check in order to prevent session ID leakage? [duplicate]

If the SessionID is leaked/hacked by someone else and they use that SessionID to get access to the account, can we double-check whether the SessionID is used on the right device? I'm thinking of ...
blamm01's user avatar
  • 25
2 votes
1 answer
112 views

Is it secure to save a salt in session variables

I know a salt isn't secure data that needs to be encrypted in the dB, but as its access should be controlled, is it considered safe to save it as a session variable at login for use later on different ...
Èl Sea's user avatar
  • 57
0 votes
0 answers
72 views

NTRU - How is the master key and session key generated?

I am learning the PKC topics and would like to understand about the master and session key generation process regarding NTRU. Let's make it a scenario, if a user wants to register during the ...
Chris Lo's user avatar
1 vote
1 answer
103 views

Refresh tokens for impersonating user credentials: how to implement them?

The web app I'm developing makes use of the concepts of "access token" and "refresh token", even though it uses its own auth scheme. In certain situations, the web app needs to get ...
Fabio A.'s user avatar
  • 125
0 votes
2 answers
139 views

"Duplicate" of Chrome Tabs causes stale tokens

Our implementation for authentication works like this User provides username/password to /login API API returns access token and refresh token in payload We store the access token and refresh token ...
Vin Xi's user avatar
  • 53
0 votes
1 answer
74 views

(Advanced) client-side session handling in browser

Is there a way (maybe via browser extensions) to make sessions forcefully expire after a while, even if the server side is set for longer durations? e.g. you authenticate to example.com and it starts ...
Aethalides's user avatar
0 votes
0 answers
106 views

httpOnly Session Cookies in an iframe context in the future w/o SameSite=None

My website is using session cookies (w/ SameSite=Lax, secure, httpOnly attributes) and a CSRF Token stored in localStorage. Recently I developed a teams app, which essentially loads the website ...
user4503817's user avatar
0 votes
1 answer
116 views

OAuth2: Storing temp values in session vs database

I have implemented OAuth2 for a web app. Everything is stored in the session, and I am switching this to a database. This makes sense for the subject and roles, but it also includes the temporary ...
Ryan's user avatar
  • 101
2 votes
1 answer
92 views

How do I handle working with/updating sessions?

I have found a lot of information on creating sessions, but I am still a little confused about working with them. For one, I am not sure how to handle updating the session on use. My understanding is ...
Jonathon's user avatar
  • 123
1 vote
2 answers
116 views

Can I set session time to 10 days without risking security issues?

We have a WordPress form that collects data on what marketing source (UTM) the user came from and upon submission, sends that UTM data to a 3rd party. Recently, a client asked me to have a web session ...
hyemark's user avatar
  • 11
0 votes
0 answers
273 views

Lax SameSite and POST (2 minute)

I was going through this link https://medium.com/@renwa/bypass-samesite-cookies-default-to-lax-and-get-csrf-343ba09b9f2b to understand CSRF using samesite. Does that mean that the LAX+POST issue has ...
Johnny's user avatar
  • 183
0 votes
1 answer
137 views

Double Submit Cookie Bypass

I am trying to work on an example for my class on how double submit cookie works and how attackers can bypass it The idea i have is I have two domain att.com and victim.com. The login functionality on ...
Johnny's user avatar
  • 183
0 votes
0 answers
95 views

What is the correct way to implement a change-of-email request flow?

I am currently implementing a change-of-email request flow for a web service without MFA. My initial approach is to consult the current OWASP Guide for such a flow. In reading the document, I've ...
peteredm's user avatar
0 votes
2 answers
507 views

can we use access token as session cookie in browser? and how to protect it?

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
Illakiya 's user avatar
1 vote
0 answers
176 views

Best practices for access and refresh tokens timeout lengths [duplicate]

I'm currently working on an international marketplace website and trying to decide the appropriate timeout lengths for access and refresh tokens. We try to do the timeouts to be as strict as possible ...
Arnas Savickas's user avatar
0 votes
1 answer
152 views

token leak by copying cookie

Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
Jacson - ANLS's user avatar
0 votes
1 answer
137 views

Authentication that immune to cookie hijacking [duplicate]

There is a website that uses a cookie to store the user’s session info. Let's assume that a hacker steals a user’s cookie to gain unauthorized access to their online accounts via some vulnerability. ...
Ghost Rider's user avatar
0 votes
0 answers
184 views

Prevent Session Hijacking with copying all metadata from a browser

For example, I'm signed in to my Gmail account. If I copy all data from all the places that Chrome uses (localstorage, all the cookies, all temp folders and so on) to another PC. How does Google ...
Ghost Rider's user avatar
1 vote
1 answer
1k views

Is there a problem with the use of HTTP cookies as auth tokens in mobile apps?

Imagine you have a website, for which you have configured a proper and secure session management / login system, using first-party / session cookies. Any interaction with that website is setup in the ...
DevelJoe's user avatar
  • 141
0 votes
1 answer
538 views

TLS session ticket vs pre-shared key state management

TLS 1.2 session tickets are encrypted by the server with the session ticket encryption key (STEK). This key is shared with all the servers doing TLS termination. The session ticket contains all the ...
user2233706's user avatar
0 votes
2 answers
423 views

Why do we use Session ID cookies on the web instead of a unique device identifier?

Session IDs aren't exactly secure, you can copy them from one device to another just by copying the browser's temp files. Techniques to tell apart one device from another have existed in browsers for ...
u7w2's user avatar
  • 1
1 vote
1 answer
102 views

Is Web session required for app security?

I understand that the idea of a session was conceived originally to improve user experience with Web applications. I also understand that session implementation can introduce attack vectors if not ...
postoronnim's user avatar
0 votes
1 answer
984 views

Identifying a session hijacking attack [closed]

I understand session hijacking has been a widespread attack vector in the past months. If an attacker steals a user’s session cookies, they can bypass 2FA and login/password. If this is the case, how ...
Mark O's user avatar
  • 3
0 votes
1 answer
792 views

What are the best practices to safely store OAuth2 tokens in a database?

I'm building a website with Patreon integration and I have identified the need to store Patreon user's OAuth2 token in the database. I'm wondering what's the best way to do that, security-wise. Some ...
Vilx-'s user avatar
  • 1,040
0 votes
0 answers
130 views

What type of token is this?

I started noticing this kind of token in a lot of CTF tasks from different authors: eyJlbWFpbCI6ImVtYWlsQG1haWxib3guZG9tYWluIiwiaWQiOjN9.ZLNCAQ.MxwKVKj_dramWyfT5XxT6g9U3xk The structure is as follows: ...
Andrey's user avatar
  • 3
3 votes
1 answer
377 views

Session Identifier: User-specific data in signed cookie vs Randomly generated session identifier

This question is inspired by looking at the functionality of the Flask-Login extension for the Python's Flask Framework (Web Framework). This extension generates a session identifier using the user's ...
WhiteFox's user avatar
0 votes
2 answers
101 views

My logged in status is being maintained 36 hours after initial login on an online account

Log in time outs can be a pain we all know. However maintaining "logged in" status whereby even if I refresh a previously open tab the next day (I hibernate my laptop each night so Chrome ...
martin_sv's user avatar
1 vote
3 answers
189 views

Security implications of using the current session to mint new access tokens

I saw a setup recently where frontend and resource servers were hosted on subdomains of the same second level domain. E.g. ui.example.com and api.example.com. It had an interesting authentication flow ...
Packager's user avatar
0 votes
1 answer
467 views

Session based CSRF Tokens - What value do i use with JWT?

The Double Submit Cookie CSRF Token pattern is a stateless technique that doesn't require storage or a database. However, it's vulnerable to session hijacking attacks and sub-/sibling domains that are ...
Advena's user avatar
  • 139
2 votes
1 answer
829 views

RDP logout necessary to prevent RDP session hijacking?

We recently got a strengthened security policy where people are required to log out of any RDP connections at the end of the day. So when I turn off my laptop, it is not enough to merely close the RDP ...
timppu's user avatar
  • 21
0 votes
2 answers
274 views

Protection against user session attacks (hijack, replay, tampering, CSRF, XSS...)

We develop a website in JAMStack, all URLs are static HTML page, and each interaction with the server are made by a fetch call on our REST API (micro-services). When a user sign in, we want to ...
lakano's user avatar
  • 157
2 votes
1 answer
420 views

Logout is just clearing cookies [closed]

My friend who is a web developer implemented his session management in a totally new way for me. He created a random sessionAPPID that is given to the user when he gives correct credentials. He then ...
rudeus123's user avatar
0 votes
1 answer
304 views

Google Security Cookies; Prevents cookie leak to malicious XHRs

Below is an excerpt from https://policies.google.com/technologies/cookies#security The ‘pm_sess’, ‘YSC’ and ‘AEC’ cookies ensure that requests within a browsing session are made by the user, and not ...
Aadithya V's user avatar
4 votes
1 answer
816 views

REST API authorization

Let say you have a REST API, which you want to use as the backend for React application. The application supports user login. You use JWT authorization to make that REST API stateless. Now the problem ...
random_đov's user avatar
2 votes
5 answers
3k views

Session regeneration after password change?

So I understand the purpose of regenerating a session ID after a state change such as authenticating, i.e to prevent session fixation. What I'm not clear on is why this would be necessary after a ...
A J's user avatar
  • 21
0 votes
0 answers
595 views

Oauth: Authorizing multiple clients at once

I have an application where the frontend app talks to 2 set of API servers: be1.domain.com and be2.domain.com both these servers are independent entities (they do share the same top level domain, in ...
gaurav5430's user avatar
2 votes
0 answers
139 views

What would be the most complete procedure to get a simple login system working securely?

I don't have formal CS education but i've written one or 2 little websites. I have troubles communicating even in my native language but i hope this is understandable. With simple i mean something ...
Silly_Code_Valley's user avatar
3 votes
1 answer
3k views

Does Cache-Control: no-cache="Set-Cookie, Set-Cookie2" actually prevent caching cookies?

This OWASP recommendation says: it is highly recommended to use the Cache-Control: no-cache="Set-Cookie, Set-Cookie2" directive, to allow web clients to cache everything except the session ...
jacob's user avatar
  • 103
0 votes
1 answer
223 views

Session cookie security

I am creating a small login system. It looks like the standard username/pwd and user can either log or register. If they pass (authenticate), I create a session cookie that will be sent with the ...
Mah Neh's user avatar
  • 35
2 votes
0 answers
1k views

Why do I have to store a refresh token in db

As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
John's user avatar
  • 21
2 votes
1 answer
303 views

use md5 hashed guid as app login and REST interface

We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest - api. All communication is over a secured https channel. The REST api is programmed to resist XSS ...
theking2's user avatar
  • 146
0 votes
1 answer
3k views

Session ID not changed after logging in/ logging out

I am testing website security when I came across this: When I enter the site URL, the user is given a session ID without any user input like: 7F746326038B30F51609423B2086BEBB Scenario 1: Once I ...
Supraja's user avatar
0 votes
0 answers
686 views

Should other devices be required to login again after an email change in settings?

I have had multiple security researchers tell me that the best practice when a user changes their email in settings is to logout all other devices and force them to login again. Nobody has been able ...
anthonyryan1's user avatar
0 votes
1 answer
604 views

TLS session tickets between proxy and upstreams

I'm planning to implement (nginx) ssl_session_tickets in addition to ssl_session_cache between a proxy and upstream. They're not located in the same DC so TLS must be in place. My questions are : 1) ...
CrazyRabbit's user avatar
0 votes
1 answer
281 views

Is passing an IDToken OK for seamless handover from app to website?

I am trying to assess the security implications for a session handover between an app and a website in the same company ecosystem. The Setup Mobile Application A and Website B use the same company ...
Vankog's user avatar
  • 103
0 votes
0 answers
44 views

Should user session be restricted to a given IP? [duplicate]

If users are authentified with a sessionID (through cookies), would it increase security if we force users to log in again if for any reason their IP changed during their session? Or is this not worth ...
caub's user avatar
  • 101
2 votes
2 answers
671 views

Multiple user sessions at the same time in a backoffice

I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management. The practice already has a backoffice-style software, but it's ...
user avatar
2 votes
3 answers
1k views

Detecting session sharing with OAuth2

In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to ...
Rifa Achrinza's user avatar
1 vote
1 answer
345 views

Is there a secure way of handling online payments without user accounts and logging in?

I'm creating a subscription-based desktop application, but there is no authentication on the platform as the "user" is the computer upon which the application is installed. This means no ...
Gumptastic's user avatar

1
2 3 4 5
12