Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
121
votes
3answers
167k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
97
votes
8answers
11k views

Do we need to logout of webapps?

A quick Google search doesn't reveal whether it is important to logout of webapps (online banking, Amazon, Facebook, etc.), or if I am safe just closing the tab or browser. I am sure I heard on some ...
49
votes
4answers
13k views

Why aren't sessions exclusive to an IP address?

Given the appropriate XSS vulnerability, an attacker can hijack somebody's session with the data that's passed to and from the server. Why aren't sessions always exclusive to the IP they were started ...
44
votes
3answers
36k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
42
votes
4answers
30k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
41
votes
5answers
37k views

Why do you need to close your browser window after logging out of a website?

I might be wrong, but I believe the request to close the browser window after logging out is common, though it's completely unclear what the risks might be of failing to close a browser window (...
39
votes
1answer
7k views

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value. Example Suppose a user has the ...
38
votes
4answers
24k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
30
votes
6answers
17k views

Can't a user change his session information to impersonate others?

Can't an attacker just change his/her session (or cookie because it's stored locally) information then fool the server that he's the legitimate user? Say for example, if a website uses the database ...
28
votes
5answers
9k views

Should concurrent logins be allowed?

We have a web app (Django) that logs users out if they haven't made a request within 1 hour. From a security point of view, is it good practice to also block concurrent log ins? In other words, if a ...
27
votes
4answers
36k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
24
votes
3answers
32k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
22
votes
4answers
20k views

Why users want to disable cookies?

I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
22
votes
5answers
3k views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
22
votes
3answers
10k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
20
votes
2answers
3k views

Is there any point in setting the secure cookie flag for HSTS websites?

If my website has HSTS and forced HTTPS (i.e. user won't be able to access the plain HTTP version of the website), is there any point in setting secure: true for the cookies?
20
votes
1answer
7k views

What kind of hashing to use for storing REST API tokens in the database?

We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...
19
votes
6answers
3k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
19
votes
5answers
1k views

Can you secure a web app from FireSheep without using SSL?

Assume that you want to give some web users privileged access to your website, but that you are unable (or unwilling) to offer SSL to all of them - at least past the initial login page. In this ...
18
votes
4answers
37k views

Is it safe to store password in HTML5 sessionStorage?

I am trying to improve the user experience on registration by not requiring the user to retype their password if validation on other fields fail. There are a few ways to implement this, example using ...
18
votes
2answers
36k views

OAuth access token vs session key

Is there any advantage to OAuth vs cookie-based sessions (established via username/password) under the following assumptions? There is only one legitimate client to the service The OAuth client ...
18
votes
2answers
13k views

Session Cookie Stealing Protection

I am looking at how to secure a web site against getting its session cookie stolen. These are the controls that I know are widely known/used: HTTPS Everywhere Only use a securely created random ...
17
votes
3answers
4k views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
17
votes
4answers
11k views

Session Hijacking - regenerate session ID

Does regenerating the session ID on each request mitigate the probability of a session hijack enough to be worth implementing? I would imagine combining a check for REMOTE_ADDR vs the REMOTE_ADDR ...
17
votes
2answers
2k views

Does it make sense to hash a session id before passing it to an advertisement partner?

My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
15
votes
3answers
56k views

What typically is the expiration date of a session cookie?

I need to create a session cookie using JavaScript (for more info see question). I'm wondering what should the expiry date be? I'm guessing it's the browsing session, so if I don't set an expiration ...
15
votes
3answers
9k views

How does FaceNiff work?

FaceNiff is an Android app that sniffs Facebook session ids. You must be connected to the same WiFi as the victim. It is said to be working even when WPA2 is present. How is it possible? I can decrypt ...
15
votes
1answer
46k views

Web app with iframe and user - how to deal with session?

We have application which will be in iframe. Partner sites can use our application - put iframe in their sites. Partner site has users with money, who will use our application in iframe to buy items. ...
14
votes
6answers
3k views

How can a user defend against session hijacking?

Given a website with various security flaws, one of them is session hijacking, session token continuously being sent as an argument over unsecured HTTP. In my field it's not surprising that others ...
14
votes
2answers
21k views

How is the session ID sent securely?

I'm learning session management and I have two questions for which I could not find answers on the web. Once the user is authenticated, the server creates the Session ID and sends it to the client (...
14
votes
2answers
37k views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
13
votes
3answers
19k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
12
votes
3answers
5k views

Why doesn't Tornado have session

I've heard that cookies is less secure than the session. For example, if a web uses a cookie to detect if an user has logged in or not, people can forge a cookie to simulate a false user because he ...
12
votes
2answers
13k views

Is it possible to force a new SSL session

Using tools like Wireshark, it's possible to decrypt SSL traffic as the client by logging the (pre)master secret, without using a mitm attack or the server's private key. But I found that for some ...
11
votes
4answers
24k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
11
votes
5answers
5k views

What do the various browser “private modes” do?

Recently there has been some disagreement as to what "private mode" means when it comes to various browsers. Primarily I am referring to... IE's "InPrivate Browsing" Google Chrome's "Incognito Mode"...
11
votes
3answers
9k views

Session Hijacking through sessionId brute-forcing possible?

cookies usually contain a sessionId to keep track of a logged user. What would prevent a malicious user to forge millions of requests with random sessionIds and send them to a server, hoping to ...
11
votes
1answer
5k views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § 2.7 ...
11
votes
1answer
981 views

Webapp2 security

I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and webapp2_extras....
10
votes
4answers
6k views

On password change in a web application, should it log out all other sessions?

When a user is logged into a web-based application in multiple tabs, and changes their password, should it automatically log them out of the other tabs? The use case is an account is compromised, the ...
10
votes
3answers
281 views

Risks of Long-life Session

Most "big" websites seem to have enormous sessions. From looking through the cookies, Stack Exchange seems to have a one-week rolling session, GitHub has 45 days, and Gmail seems to have a never-...
9
votes
5answers
17k views

Why do banking websites always log you out after inactivity?

It seems that every single banking & financial website that I have used logs me out after a certain period of time. Are there a legal requirements or technical reasons for financial sites to do ...
9
votes
4answers
2k views

Is a session token enough for critical applications

So for years I have been using various user checks on top of the session token they are issued to maximise security. I am now looking at developing a session system across separate servers and am ...
9
votes
5answers
2k views

Should a user have the ability to be logged in from multiple locations at the same time?

In the past, I've always used a single session per user setup, but I'm working on a project now where a user can be signed in from multiple locations/browsers at the same time. What are the security ...
9
votes
3answers
2k views

How do mobile apps maintain such long sessions while still being considered secure?

I opened my Amazon iOS app for the first time in several months today, and was able to go straight through checkout (where I was able to view and update my address) without being asked to re-auth. How ...
9
votes
1answer
11k views

Changing session id after login

My web application is only accessible for authenticated users. Before login the user can only see the main page with a button to log in. The application assign a session ID on the main page, the ...
9
votes
2answers
14k views

When should server side sessions be used instead of client side sessions?

From an information security perspective, when should server side sessions be enabled instead of client side sessions? From what I gather, "secure client side sessions" are cookies that contain data ...
9
votes
1answer
8k views

Will session_regenerate_id() without true parameter improves security? Should I use it right before login?

I want to decrease session fixation attack vulnerability, hence I used session_regenerate_id() before login. Somehow I'm in dark now and not sure the right answer for questions below: When we don't ...
9
votes
2answers
22k views

Where and How is data stored in a session?

Where is the information in the fields of a session stored? If I, for instance, store in a session something like $_SESSION['foo'] = 'bar'. Where is "bar" stored? If I store an object of a class, in ...
9
votes
2answers
11k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...

1
2 3 4 5
11