Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

68 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7
votes
1answer
3k views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
3
votes
0answers
120 views

How can I implement CSRF Tokens without server-side rendering/templating?

I am attempting to build an application that submits numerous fetch/XHR requests to a NodeJS backend. I'd like to implement CSRF token protection, but would like to avoid implementing server-side ...
3
votes
0answers
115 views

Should you terminate a session when an incorrect CSRF token is submitted?

According to the OWASP CSRF Prevention Guide if the server fails to ...verify the existence and validity of the token in the request compared to the token found in the user session ... then the ...
3
votes
2answers
146 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
3
votes
0answers
478 views

SAML 2 | Refresh IdP Session when user is working on SP

Wanted to discuss the solution and options to refresh the IdP Session when user is actively working on the SP. The use case is that after successful SP-Initiated SSO, there are two sessions in ...
3
votes
0answers
92 views

How to group user actions within the same session?

I'm working on enterprise application where it's needed to audit all user actions (data modification, settings changing etc.) within their work session. What is the best way to group all that actions ...
2
votes
0answers
106 views

How does proper use of session.use_only_cookies and session_regenerate_id() cause personal DoS?

From PHP Session Management basics: Proper use of session.use_only_cookies and session_regenerate_id() can cause personal DoS with undeletable cookies set by attackers. In this case, developers may ...
2
votes
0answers
57 views

Can we use cookie session id value in the body of the request?

A tester mark this as a vulnerability in the web application that a session id is in the post request instead of cookie header.
2
votes
0answers
91 views

logout all devices or only one

I wonder which is the best practice in terms of security. Assuming an application where one can login from multiple devices in parallel what I should expect from "logout" button? To logout the user ...
2
votes
0answers
835 views

JWT as a nonce in sessionless backends

I'm creating an API server (a gateway) with two restrictions in mind: It has to be sessionless (no session id in a cookie or anywhere, no Redis or anything like that) I have to use an implicit grant ...
2
votes
0answers
121 views

Web app crypto scheme

For learning purposes I am trying to build a web application (Symfony2, PHP) that allows users to post content and have their own password vault, everything encrypted. Since I want to users to be able ...
2
votes
0answers
428 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
2
votes
2answers
970 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
2
votes
1answer
84 views

Does embedding (concatenating) a user ID in a session token for logging have any security implications?

Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that ...
1
vote
0answers
36 views

Is it bad practice to use only one token for a SPA (no applications, only user)?

Say we have multiple instances of application X deployed on site1.com, site2.com, site3.com, etc. And we have a centralized server at example.com serving all of these. All the instances of X are ...
1
vote
1answer
53 views

How to handle session absolute lifetime during user activity?

I'm implementing a web login system and am confused about how to think about when authenticated sessions (not just browser sessions) should be expired. There seem to be 2 factors: absolute lifetime ...
1
vote
1answer
97 views

Cookieless Authentication

I am working on an authentication server that can act as a central place to manage authentication for multiple projects, sort of like keycloak or ory kratos. While working on implementing ...
1
vote
0answers
33 views

mORMot 1.18 doesn't invalidate session_signature after logout? is this the default behaviour?

On a website which uses mORMot 1.18 every request made by an authenticated user is in this format: ../search_items?session_signature=0000004C000F6DD02E24541C as reported within the framework docs ...
1
vote
0answers
62 views

Change of domain without having to log in again

The question concerns the idea of transferring sessions between domains without having to log in again. I would like to do it like this: (user is logged in and changes the language to a language from ...
1
vote
0answers
50 views

Can I use a persistent SID cookie for 'remember me'?

For the moment I implemented a login form asking for a username and a password and returning a session id (SID) that is stored in a cookie, without setting max_age or expires so that it will be ...
1
vote
1answer
67 views

Sessions With JWT

I'm currently implementing a REST Api for a Single Page Application and Mobile App. Any 3rd party login or grant access to them is not required. I've microservices behind a gateway (all HTTPS). My ...
1
vote
0answers
88 views

Explanation for maldetect advice

I received a notice from maldetect on an Apache machine I'm running, and I've not seen an advice like this before. I'd like to get a better understanding of exactly what I am looking at. I received ...
1
vote
1answer
436 views

What is the connection between CORS and SameSite cookie attribute?

For most of them may be its a silly question but I want it to know this in very simple language. If an application is not using CORS at all then should we put this SameSite cookie attribute? and if ...
1
vote
0answers
89 views

Are JWT still not recommended for sessions?

It seems there is a large divide as to wether or not you should have JWT or Session ID for managing user session on WebApp/API (for a web front end or/and a mobile app). It seems that the consensus ...
1
vote
0answers
140 views

Best way to let 2 servers communicate (with PHP) avoiding IP Spoofing?

Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP ...
1
vote
0answers
218 views

gpg won't find public key if not in interactive session

How to make imported public key available after logging off? I have a Powershell process that encrypts the file (recipient was masked): Start-Process "gpg.exe" -ArgumentList "--batch --yes --always-...
1
vote
0answers
74 views

Configure Burp to pass dynamic authentication token from the past response to the next request in intruder

I would like to reuse an authentication token (which is dynamic) between a response and a request in Burp Suite intruder. By dynamic I mean that the token is invalidated after being sent to the ...
1
vote
2answers
411 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
1
vote
0answers
47 views

Rotating session names vs a static session name with a rotating validation string

I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
1
vote
0answers
55 views

Generating session with id and password

Most web apps generate a long hex number and use it as a sessionid. My idea is to create an ID which is auto-incrementing for each generated session and assign it a random secure string (a password). ...
1
vote
0answers
66 views

What are the security benefits of creating a session vs. just using Google ID token every time in my server back end?

I'm using Google Sign In to authenticate my users with my server back end via my Android app. So far I am able to sign in and obtain an ID token, which I then send to my server back end for ...
1
vote
0answers
276 views

Add to cart CSRF Token

I have CSRF tokens everywhere on my e-commerce site that use POST forms. However, I don't want to start a session (with a cookie) unless absolutely necessary (mainly because I'm using varnish cache, ...
1
vote
0answers
350 views

Can a CSRF token be used as a session identifier instead of a cookie?

Someone has asked the same question here: Should CSRF token without session cookie work? but the people answering seem uncertain. So, why does anyone need a cookie at all if they are using a token ...
1
vote
0answers
70 views

What is the most secure method for web session handling for multiple domain?

Based on the current standing of web security, what is the most secure / recommended method for web session handling: session cookies, cookie jars, web tokens, or anything else? The requirement is to ...
1
vote
1answer
871 views

SAML Without Session

Is there a way to implement SAML-based authentication to an IdP where the client keeps the session information? The idea is that a load-balanced server farm for the SP would be able to remain ...
1
vote
0answers
221 views

Passing Encryption Key Across Session for Symmetrically-Encrypted DB

I'm building a database that symmetrically encrypts user data. Nothing super sensitive, I'd use a third-party if it was. The data is encrypted with a surrogate key; the user must enter a password to ...
1
vote
0answers
3k views

Do I keep my PHP simple auth session secure enough?

I'm experimenting with security, cryptography and web applications. My aim is to create simple login system that is realy secure enough. I'd like to share my approach to keep authenticated session ...
1
vote
0answers
1k views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
1
vote
2answers
3k views

If I am using a VPN with allowed multiple connections can each user/device be able to view traffic of the other user?

If I am using one a VPN Service, but it allows up to lets say 8 devices to connect, are all the devices/users able to view traffic from other users/devices? Or is each VPN connection creating its own ...
0
votes
1answer
68 views

How to securely store and use session IDs

I'm not sure what's the option to store and manage session IDs for long lived sessions (3-6 months each). Given that the session ID is generated with enough entropy and that the session ID is then ...
0
votes
0answers
27 views

TLS Session Resumption for static content and JavaScript

This is an observation of SSL/TLS Resumption that maybe someone can help explain why SSL/TLS resumption is NOT shared between static assets and Javascript. Basically, I tested using two pages: pageA ...
0
votes
0answers
47 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
0
votes
0answers
44 views

Is there a good reason not to track valid JWTs in a key value store like redis?

I use Redis to track valid JWTs by saving the JTI (uuid-v4) mapped to the users id in Redis. If the JTI can not be found in Redis or the user id in Redis does not match the user id in the JWT the ...
0
votes
0answers
42 views

Designing a user session API for both mobile and web clients

I'm currently working on a project. The apis on the backend will support both mobile and web clients. I'm attempting to design a user management flow for both clients and a bit confused about how to ...
0
votes
0answers
57 views

Can python be used to retrieve a session ID to mimic logged in user at periodical times?

Let me quickly explain and then ask the question. I'm developing a Web Vulnerability assessment scanner for a project, and I'm learning python as I go, so forgive me if it might sound like a dumb ...
0
votes
0answers
72 views

OpenId Connect Authorization Code Flow, using refresh token to renew id_token? And subsequently issueing a new cookie

I am currently working on implementing a proof of concept for ADFS (2019) (which I managed succesfully) and Azure AD with renewing the cookie / id_token by doing a refresh_token call in the backend of ...
0
votes
0answers
103 views

What is the term for data leaking from one HTTP request to another and how to prevent it?

Context We recently added a feature that used a library whose API we misunderstood. Long story short, if user A sends a request to our web application, the library caches some result, and that result ...
0
votes
0answers
47 views

What if session cookie is stolen? Doesn't it have a similar effect with getting access token stolen

Most security specialist teams, OWASP, Auth0, Okta to name some, agree on that keeping access token in browser should be avoided. And one of the alternatives to this approach is having a proxy server ...
0
votes
0answers
186 views

Simplest secure way to create session cookies

Background: I've been using a simple session cookie design for my web app. I have a users table, and a sessions table that basically looks like this: id | user_id | visited_at -----+---------+-------...
0
votes
2answers
702 views

Is it safe to store session state of different apps in single Redis cluster?

We have "web app as a service" offering. And right now each app has its Redis which stores session data. Is it secure if we use one redis cluster for all clients using this app. To be clear ...