Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
1
vote
2answers
101 views

Can we simply re-salt password on suspected session hijack?

Looking at people complaining about Yahoo forcing users to change their passwords. We can see that people do not particularly like to change passwords (and whether we change them regularly is an ...
20
votes
1answer
7k views

What kind of hashing to use for storing REST API tokens in the database?

We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...
2
votes
2answers
7k views

Does exposing a session ID create security risks?

I'm looking to make a cross-domain + single app login, since you can't store cookies on other domains from one website, I'm using img tags with a href link to each website (eg: example.com/...
3
votes
3answers
1k views

Why doesn't a cookie persist across different machines?

I am running Chrome with a specific --user-data-dir on removable storage that allows me to maintain a single browser session on different machines throughout the day (history, bookmarks, extensions, ...
0
votes
1answer
298 views

Is this authentication scheme using JWT secure?

I was wondering if you could review this authentication scheme for web application. === Login Page === Credentials Verification => Server issues JWT => Stored in a Cookie JWT contains: exp: ...
0
votes
1answer
482 views

Why cant I bypass user authentication by copying cookies?

I am getting confused by a website cookie authentication process. I captured the packets going from the website and saw the cookie being sent. I copied the entire cookie content of the website and ...
1
vote
2answers
998 views

what is the security issue if session time out is the default value from server configuration?

In a web-application the session time-out is not defined neither in the application nor in the application configuration. But the default time out is taken from the IIS. what is the security issue if ...
1
vote
1answer
76 views

Should Lockout Terminate The Session?

I think it is OK not to terminate existing sessions if user is locked out due to a number of login attempts with the wrong password. Because it might be an attack and it would be inconvenient to ...
5
votes
2answers
4k views

What is the security risk of enabling persistent connection (HTTP Keep-Alive)?

By my understanding, the HTTP Keep-Alive header dictates whether the next packet of communication will be sent over the same connection or not, i.e., if the web app runs over SSL, and a Keep-Alive is ...
0
votes
3answers
1k views

Storing session in querystring

I'm applying for a program through organization X's website. I logged in, and was astounded to find a URL like this: https://www.whatever.org/application?session=80_CHARACTER_HASH 80 characters in [...
3
votes
3answers
8k views

How do I store session data on a server securely

I'm building a system where security is important and I'd like to store session details on the server in a session table. However, I'm concerned that if an attacked got hold of the database, they ...
4
votes
1answer
258 views

Should Each Web Request Be Logged

I frequently see that logging the IP of the user is advised. I thought of attaching this information to the session record in the database but IP can change during the lifetime of a session. And if ...
14
votes
6answers
3k views

How can a user defend against session hijacking?

Given a website with various security flaws, one of them is session hijacking, session token continuously being sent as an argument over unsecured HTTP. In my field it's not surprising that others ...
0
votes
1answer
79 views

Protecting Session Authentication Tokens

I am creating a session authentication token and sending it to the client application. Any user data etc is associated to this token on the database, so the token does not contain any sensitive ...
2
votes
1answer
204 views

Is storing session data in the DMZ ok in an n-tier enterprise web application?

Say I have a standard multi-tier web application with web servers in the DMZ and multiple services only accessible from an authenticated web app. Also let's suppose the web app uses server-side ...
2
votes
1answer
847 views

Inducing TLS renegotiation

Is it possible to induce ssl renegotiation for a browser via command line / a curl request. I know it is possible to rate limit ssl renegotiation but do not know how to do it the other way around. I ...
4
votes
4answers
307 views

Causing Denial of Service by “Session Spaming”

Let's assume you have a single sign on ticket and you logon to a website which authanticates you by the ticket (same thing with user/password). The webserver will create a session and the user stores ...
2
votes
3answers
6k views

Is it safe to use session to check if the user is logged in?

I searched "how to check if user is logged in" and most of the answers that I found (on Stack Overflow) are to use PHP sessions. My questions are: Should I solely rely on PHP sessions to check if the ...
2
votes
2answers
362 views

Prevent session hijack on blog service?

I have a service where webmasters can create a website (including the use of javascript). A user can place a comment on the website of a webmaster. A user only needs to register and login once and ...
1
vote
0answers
350 views

Can a CSRF token be used as a session identifier instead of a cookie?

Someone has asked the same question here: Should CSRF token without session cookie work? but the people answering seem uncertain. So, why does anyone need a cookie at all if they are using a token ...
2
votes
5answers
4k views

Struggling to demonstrate/exploit a basic session hijack

As part of some basic pen-testing I've been invited to do on a live site, I've managed to access other users' cookies. The first thing that springs to mind that could be used to demonstrate the ...
-1
votes
1answer
77 views

Security mechanism for quick checkout (without cookies/session id)

I am implementing quick checkout in my e-store. Customer only have to enter email and phone number to make an order, system checks whether customer with such fields already registered, if not it ...
4
votes
1answer
6k views

How to securely store accesstoken in android

I have a web application which stores its accesstoken in localstorage. It also has an android application which is basically a webview wrapper of the web application. In this case, the local storage ...
2
votes
1answer
154 views

Is it a security risk that browsers can freely get images (and/or other resources) cross-domain?

Same origin policy protects us from malicious site manipulating the data on our trusted site by not allowing requests that would send the auth cookie e.g. But if I understand correctly images, scripts,...
1
vote
1answer
212 views

Is there any benefit to keep sending UN/PW to the server over Session ID ( i.e., Stateless vs Stateful)

I was reading this question about Session ID Hijacking and it gave a lot of answers about stealing Session IDs. I have been thinking about this for awhile, but is there a benefit to using Session ...
0
votes
2answers
3k views

Session Management: Set new value of session ID after privilege change and other sensitive operations

This OWASP Article on session management recommends to set a new value of session ID when: Common scenarios must also be considered, such as password changes, permission changes or switching from ...
1
vote
2answers
173 views

Is there an added risk in passing session token in message body?

We're working on a mobile app and are using session tokens for authentication with a back end server. Is it a security risk to pass the session token from the client to the server in the body? This ...
2
votes
1answer
71 views

Testing a black-box for sound authentication session config

How would I test that a website I'm successfully authenticated on (currently in session) has set my session ID in a safe way and isn't vulnerable? I believe a session ID should be obscured at the ...
30
votes
6answers
17k views

Can't a user change his session information to impersonate others?

Can't an attacker just change his/her session (or cookie because it's stored locally) information then fool the server that he's the legitimate user? Say for example, if a website uses the database ...
49
votes
4answers
13k views

Why aren't sessions exclusive to an IP address?

Given the appropriate XSS vulnerability, an attacker can hijack somebody's session with the data that's passed to and from the server. Why aren't sessions always exclusive to the IP they were started ...
4
votes
2answers
3k views

Why would the session ID entropy only be half of the length of the session ID?

On this page on the OWASP website, there is a sentence about session id entropy I find quite strange: The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this ...
2
votes
2answers
2k views

Comparing Session Hijacking, Fixation and Riding

How do I differentiate between these Session Hijacking/Session Fixation/Session Riding. I find it difficult to understand when read about all three at the same time. I get very confusion between when ...
5
votes
3answers
4k views

Should I also hash my session id before storing it in the database? [duplicate]

I'm writing an API that hands out session id's using PHP's uniqid function (yes using more entropy). However I'm wondering if it adds more security to hash this id on the server, just like the ...
6
votes
1answer
5k views

Sending session cookie inside the HTTP response body

It's known that the secure practice of setting a session cookie is using Set-Cookie header with Secure and HttpOnly flags. But is there any security issues with sending cookie inside the HTTP response ...
1
vote
1answer
826 views

insecure HTTP session issue

A java based application supports two user roles. Admin and nonAdmin. Login as Admin ,browser gets JSESSION ID. Login as nonAdmin user from another machine. Browser gets another JSESSION ID. Now ...
1
vote
2answers
38 views

allow user to delete individual sessions on account, safe to embed sessions in HTML?

I am currently building a web application that allows user to view all active sessions connected to their accounts, and if they want to, delete them individually - like Dropbox One way I want to ...
8
votes
2answers
6k views

Session cookie secure flag: best practice

There are 2 ways of setting 'secure' flag on a session cookie: In the application itself, for exemple: <session-config> <cookie-config> <http-only>true</http-only>...
2
votes
2answers
1k views

Does encrypting a key (stored in cookie) increase security?

Scenario Master key is entered upon login then encrypted with $server_key Master key is now stored as $_COOKIE['encrypted_key'] variable for persistence (so user doesn't have to enter it every page ...
1
vote
1answer
818 views

Storing encryption key in $_SESSION vs $_COOKIE?

Reading the tutorial here: https://github.com/defuse/php-encryption/blob/master/docs/Tutorial.md (scenario #2) It is advised to store the encryption key in a session variable. I was wondering, is it ...
3
votes
2answers
379 views

How to secure store sessions values in webapps?

EDIT: I changed the title of this post from "How to manage sessions in webapps?" to "How to secure store sessions values in webapps?" as it might have been misleading In the recent months I happened ...
1
vote
2answers
223 views

Sign in a user or not after they verify email address?

So in a typical web-app scenario, the new user is sent some sort of email with a one-time, time sensitive token link which when clicked will "activate" their account or "verify" their email address. ...
1
vote
2answers
904 views

URL rewriting of session cookies

I stumbled over this in the ASVS 3.0.1 (V3.6). I wonder what this is, I couldn't find any meaningful explanation.
1
vote
3answers
1k views

Cookie ASPSESSIONIDSACSARTD created without httponly flag

I'm just learning right now about different analysis tools and I came across something in a nikto scan last night on a VM server I own. It said something along the lines of: Cookie ...
1
vote
4answers
1k views

What does hacker need to steal from my PC to compromise my Facebook session?

I mean, when I tick the "remember me/this computer" button, I don't need to login again on this machine. So I guess it's because of cookies. So if someone would get on my PC, he could steal some files ...
1
vote
2answers
46 views

Security risks on given session infrastructure

I want to know if this is a suitable schema for session management. Once the user has authenticated with user/pass, the server returns session = MD5(SECRET + user_id) (along with other fields) where ...
1
vote
3answers
563 views

Does appending a hash of a timestamp to a randomly generated string make it less secure?

I have the following code for generating session tokens: binascii.hexlify(os.urandom(16)) + hashlib.md5(str(time.time())).hexdigest() which converts the randomly generated 16 bytes suitable for use ...
3
votes
2answers
5k views

Renew access token for OAuth2 implicit grant

We want to use the OAuth2 Implicit Grant as it is proposed for single page applications. For JavaScript applications which don't have a classic web session. The applications only have access tokens ...
4
votes
4answers
2k views

Saving passwords and remember me functions

(BTW, this is all coded in PHP as I'm sure you'll be able to tell from the function below) When saving passwords, I am aware that you have to hash your passwords, in fact here's my code (tell me if ...
1
vote
1answer
681 views

Do I need CSRF token, and how it adds me additional protection (Angular/Node SPA)

I was reading about XSRF and I'd like to ensure that I understand the problem correctly and know if my application is protected against that kind of attack. How I understand CSRF works: adding a ...
2
votes
2answers
14k views

Is it required to end the session after closing the browser without logging out?

Should the Session ID generated after logging in be marked invalid when the user closes the browser without logging out? Could this be a security flaw? If yes,is it possible to exploit this?

1
3 4
5
6 7
11