Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
0
votes
0answers
47 views

TLS Session ID from Client's First Visit

Why would a client send a TLS session ID (96b839ce3aadb65780923d28a3e7e767fc5bddc507884a7e70e506d8b85a06d3 on its first visit to a server/website? My understanding is that the client would include a ...
1
vote
1answer
592 views

Using a persistent httpOnly cookie for authentication? (SPA)

So I'm building an application that needs authentication, I'm wondering if there's an security concerns with using a persistent httpOnly cookie to store user authentication with a SPA? (only 1 server. ...
0
votes
2answers
100 views

Is it safe to save a user's email into php session variable for later use?

I'm in the process of creating a password reset functionality for my project. I currently have my website send a password reset link to the user's email if they request it and validates the link ...
1
vote
1answer
127 views

Is it a security risk to strore item IDs in sessionStorage?

I've been working on an eCommerce store for people to be able to buy items. I want to implement a basket system for this store. Looking at lots of other posts, it is clear to me that there are ...
1
vote
1answer
68 views

How to ensure JWT security in authentication?

I have implemented a backend as a REST API. To maintain the statelessness in REST, I intend to use JWT to verify that that a user has logged in or not. (A user is logged in if a valid token is present ...
2
votes
1answer
139 views

Double JWT submit method

I'm implementing my JWT method by using the double submit method: where we separate the payload & header portion of the JWT from the signature. The header & payload is stored in a separate ...
28
votes
5answers
9k views

Should concurrent logins be allowed?

We have a web app (Django) that logs users out if they haven't made a request within 1 hour. From a security point of view, is it good practice to also block concurrent log ins? In other words, if a ...
1
vote
2answers
3k views

If I am using a VPN with allowed multiple connections can each user/device be able to view traffic of the other user?

If I am using one a VPN Service, but it allows up to lets say 8 devices to connect, are all the devices/users able to view traffic from other users/devices? Or is each VPN connection creating its own ...
0
votes
3answers
102 views

Sending static registration links via email

In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
1
vote
1answer
270 views

Session sync between two web apps on the same domain

I have a Laravel 6 site, and a legacy Drupal 7 site. Both are served under the same domain, and both share the same user database table. I'd like users to be able to log in via Laravel (never via ...
4
votes
1answer
1k views

Is session/cookie based authentication stateful or stateless?

Flask Web Development says The current login functionality implemented with the help of Flask-Login stores data in the user session, which Flask stores by default in a client-side cookie, so the ...
1
vote
2answers
75 views

Should I avoid authenticating the user unnecessarily to a server?

I’m thinking a RESTful client–server architecture. There will be routes that require users to authenticate before they can access the resource (e.g. creating or editing resources). Other resources are ...
0
votes
0answers
142 views

Firebase token storage on logout

We are looking to implement push notifications for things like when a user receives an internal message within our app. We have an application with sensitive data so we have a short length inactivity ...
0
votes
1answer
352 views

Sending httpOnly cookie also in HTTP response body

I've done some researches on this topic, and I found this question on SE: Sending session cookie inside the HTTP response body But this answered my question just in part. On login, my server will ...
3
votes
1answer
634 views

What attacks are prevented using Session Timeout or Expiry?

OWASP recommends setting session timeouts to minimal value possible, to minimize the time an attacker has to hijack the session: Session timeout define action window time for a user thus this window ...
3
votes
2answers
146 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
2
votes
1answer
3k views

Session id in custom header

Is there a way to perform session fixation attack with XSS present if session id is passed in request header? As far as I see it, theoretically there are three ways to do so: intercept request on ...
2
votes
1answer
160 views

Should I hash session IDs before storing the session contents?

I am wondering if it is smart to hash my session IDs before writing sessions to the session storage, in order to prevent session ID disclosure. I am writing an application in PHP on top of the ...
0
votes
1answer
90 views

Security Considerations To Account for When Redirecting From Microservice to Another

I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
1
vote
2answers
202 views

Session ID containing username?

Is it safe to append the user's username to the session ID? The session ID is 32 bytes long generated using a secure PRNG. I encode it using base64 URL to save it in a HttpOnly cookie. The cookie ...
1
vote
2answers
453 views

Hashing Session ID

For my app I use redis as a session store. Is it safe to store the session id without using a hash function? If I should use a hash function, the client would receive the cookie with the raw or the ...
0
votes
2answers
114 views

Baking a better cookie - How can we prevent a high-jacking of the user's local cookie file to exploit accepted cookie use?

This question is similar to Hashing cookie-values & preventing cookie-stealing however, it is significantly different as I am interested in preventing (internal) subscription fraud, rather than an ...
0
votes
0answers
58 views

Why use a refresh token for authentication?

I recently stumbled upon this article which recommends using two tokens for authentication. Once the user is logged-in (or registered), the client receives an access token and a refresh token, ...
1
vote
1answer
2k views

Backend Authentication of Mobile App: Session ID vs. OAuth

Currently I am developing an iOS/Android app and a corresponding backend in PHP. In the last days I read a lot about user authentication and now I am a bit confused. For now I am using a session ID ...
1
vote
0answers
140 views

Best way to let 2 servers communicate (with PHP) avoiding IP Spoofing?

Let's say I have my ServerB that accept any request and it checks the PHPSESSID and compares the IP saved into the session (thanks to session values) with the IP that made the HTTP request. The IP ...
0
votes
0answers
45 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...
1
vote
0answers
63 views

Cannot remove an unknown active session from my Facebook account [closed]

Cannot remove an unknown active session from my Facebook account . My Facebook account was hacked and I changed my password, then i deleted my active sessions. There was one session from MI that it ...
2
votes
1answer
564 views

Security Risk of Stolen Session ID vs Authentication Token

I was intrigued by the discussion of this SO question as well as the accompanying blog post. I'm trying to better understand the mechanics of the two systems, and one of the questions I came up with ...
1
vote
1answer
164 views

Is an index, nonce and HMAC good enough for session management?

The scope is server-side session management with session payloads being sent to the client in a cookie. I'm researching session management for web applications. I've been looking at a couple places, ...
0
votes
1answer
930 views

Storing encrypted tokens in LocalStorage

I am building a JavaScript application that will run in a web browser but also as a pseudo-native mobile application via Apache Cordova. It communicates via API to a separate backend service. The app ...
1
vote
0answers
218 views

gpg won't find public key if not in interactive session

How to make imported public key available after logging off? I have a Powershell process that encrypts the file (recipient was masked): Start-Process "gpg.exe" -ArgumentList "--batch --yes --always-...
2
votes
0answers
57 views

Can we use cookie session id value in the body of the request?

A tester mark this as a vulnerability in the web application that a session id is in the post request instead of cookie header.
1
vote
2answers
58 views

Serverless Apps Authenticate Users After Page Load - Flaw?

Server-based apps check for a session cookie before returning any content to the user. If an authentication cookie isn't sent from the user's browser, the only content delivered to the user is a ...
4
votes
1answer
226 views

2FA/MFA and Session management

Background Recently observed researchers reporting bugs related to a situation where a website would not invalidate secondary (separate) active session once 2FA/MFA has been enabled in primary ...
0
votes
2answers
428 views

Is a web app vulnerable if it only uses session token in cookie to authenticate a user

I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability. The ...
0
votes
0answers
26 views

Can I rely on Google id_token for web session?

I'm building a website without a "server": JavaScript and AWS Lambdas as back-end through API Gateway. Knowing there is no solution for session when using lambdas, I was wondering if I could only use ...
2
votes
3answers
82 views

Is it advisable to tie different capabilities to different session tokens?

Let's say you're creating a banking web application with mobile apps. A bank user has permissions "transfer money" and "view balances." When a user logs in, we can create a session token (typical ...
2
votes
1answer
114 views

Firefox 68 — any changes affecting CSRF capabilities?

My Ubuntu 18 system did an upgrade to Firefox 68 (presumably from 67.x). I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid ...
1
vote
0answers
74 views

Configure Burp to pass dynamic authentication token from the past response to the next request in intruder

I would like to reuse an authentication token (which is dynamic) between a response and a request in Burp Suite intruder. By dynamic I mean that the token is invalidated after being sent to the ...
3
votes
1answer
726 views

Why sign session cookies? [duplicate]

I'm using express-session middleware to store sessions on the server. The client's browser gets a cookie with the session ID. A secret is required in the configuration; it is used to sign the session ...
0
votes
1answer
134 views

Is it a bad practice to send sensitive information(like a session id) in the aspx response?

Lets say I have an aspx login page which validates user credentials, obtains a session id and then redirects to the home page in the following way. login.aspx: var sessionId = ValidateCredentials(); ...
1
vote
2answers
8k views

What is the most secure way to store cross subdomain cookies

I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
2
votes
1answer
142 views

Is there any benefit to using a salt when the cleartext is random data?

I understand that using a salt makes it harder to find cleartext using rainbow tables - but in that scenario the clear text is structured / low entropy. If my clear text is generated randomly, then is ...
0
votes
1answer
46 views

Cancelling a request stops new authentication cookie getting to browser, invalidating all further requests

I am trying to secure my login system using authentication cookies. If the user tries to access a protected resource they must provide an authentication cookie. If the cookie is valid, the request is ...
0
votes
2answers
140 views

Is there another way than session hijacking to access user account through XSS?

If I have discovered an XSS vulnerability, is there another way of gaining access to an account without session hijacking? Mainly because on most of the sites I test, the HttpOnly and Secure flags are ...
0
votes
2answers
74 views

Are JWT's the way to go in my situation?

I am working on a personal project for learning reasons, and have come to the point of authenticating and authorizing users. I would like to keep the project as stateless as possible, to make sure it ...
1
vote
2answers
411 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
1
vote
1answer
67 views

Is it recommended to send an authentication request to the Resource Owner (by the Authorization Server) if it already has an active session?

In OAuth 2.0 Authorization Code Flow (Grant Type), is it recommended (or is it maybe even a best practice) to send an authentication request (e.g. a login-request form) to the Resource Owner (by the ...
2
votes
1answer
501 views

How could ASP.NET forms authentication session leak into a different site?

We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site. I can't figure out how is IIS or ASP.NET allowing this to occur Steps: Login to ...
2
votes
3answers
2k views

Why are ASP.NET form authentication cookies deleted only on client side if client side can't be trusted?

ASP.NET documentation says: FormsAuthentication.SignOut() Removes the forms-authentication ticket from the browser Why is the cookie not invalidated at the server as well? It would be easy ...

1
2
3 4 5
11