Questions tagged [session-management]

Management of semi-permanent interactive information interchange between two or more communicating devices, or between a computer and user

Filter by
Sorted by
Tagged with
3
votes
2answers
4k views

Placing IP address in JSON web token or session cookie

I'm relatively new to security and I'm looking to prevent brute force logins on a web application I'm creating. After doing some research, I decided to go with requiring a captcha after a user ...
9
votes
3answers
3k views

How do mobile apps maintain such long sessions while still being considered secure?

I opened my Amazon iOS app for the first time in several months today, and was able to go straight through checkout (where I was able to view and update my address) without being asked to re-auth. How ...
3
votes
1answer
1k views

How do cookies work together with token binding?

Token binding is a mechanism where the client sends an signed token to the server. Because this token is based on a private key it is harder to steal than session cookies. What I don't understand is ...
1
vote
0answers
43 views

Vulnerable web apps for testing session identifier prediction [closed]

I want to learn testing session identifier strength. So I need a web application with this type of vulnerability and run the app locally. I've tried WebGoat, but I need some other web apps known to ...
1
vote
1answer
4k views

Can a meterpreter session be reopened? [closed]

I tried to hack multiple android phones using .apk files but everytime the session lasts 5-10 seconds: [*] 94.243.71.172 - Meterpreter session 1 closed. Reason: Died Then, to open a new session ...
2
votes
2answers
2k views

Session hijacking mitigation

I would like to reduce the likelihood of session hijacking by implementing a cookie based token solution. The idea is to generate a SHA256 hash based on client related information such as: PHP $...
2
votes
1answer
2k views

Multiple Sessions in one SSL connection

Usually, one SSL session is used by many connections. I was reading about SSL while I encountered something interesting. It said that: In theory, it may also be possible that multiple sessions are ...
4
votes
1answer
112 views

How often should secrets be regenerated for token-authentication?

When implementing token-based authentication, is it recommended to regenerate secrets on a periodic basis? This is assuming the tokens generated have expiration.
0
votes
2answers
53 views

Possible vulnerabilities from letting users set session values manually?

I visited this site where I was able to set the language in the main page. When I clicked on the language link I got an URL like site.com/index.php?lang=us and was redirected to the home page. On the ...
0
votes
1answer
843 views

How would you explain CSRF token to a newbie? How is it safer than cookie based approach?

I have a pretty basic understanding of both approaches but just looking for a better explanation I guess. I have seen some examples of CSRF attacks, using CSRF tokens, how frameworks like Ruby on ...
5
votes
1answer
1k views

Session renewal how often is necessary?

I am looking at the session management again of a site and currently it renews the client session id on every page refresh. The idea being that if it is stolen directly from the browser there is less ...
2
votes
2answers
2k views

Testing Session Fixation when cookie is unchanged

I was testing a web application where cookies (session ID, session values) are the same for all times. Even after successful authentication takes place it remains unchanged. The session ID travels in ...
2
votes
1answer
629 views

How to handle OAuth2 refresh_token for sessionless login?

I'm working on a single-page sessionless app with OAuth2 login and a "Remember me" checkbox. When the user checks "Remember me" on login I store the refresh token in LocalStorage for 30 days. It feels ...
1
vote
2answers
107 views

Can we simply re-salt password on suspected session hijack?

Looking at people complaining about Yahoo forcing users to change their passwords. We can see that people do not particularly like to change passwords (and whether we change them regularly is an ...
21
votes
1answer
8k views

What kind of hashing to use for storing REST API tokens in the database?

We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...
2
votes
2answers
7k views

Does exposing a session ID create security risks?

I'm looking to make a cross-domain + single app login, since you can't store cookies on other domains from one website, I'm using img tags with a href link to each website (eg: example.com/...
3
votes
3answers
1k views

Why doesn't a cookie persist across different machines?

I am running Chrome with a specific --user-data-dir on removable storage that allows me to maintain a single browser session on different machines throughout the day (history, bookmarks, extensions, ...
0
votes
1answer
304 views

Is this authentication scheme using JWT secure?

I was wondering if you could review this authentication scheme for web application. === Login Page === Credentials Verification => Server issues JWT => Stored in a Cookie JWT contains: exp: ...
0
votes
1answer
519 views

Why cant I bypass user authentication by copying cookies?

I am getting confused by a website cookie authentication process. I captured the packets going from the website and saw the cookie being sent. I copied the entire cookie content of the website and ...
1
vote
2answers
1k views

what is the security issue if session time out is the default value from server configuration?

In a web-application the session time-out is not defined neither in the application nor in the application configuration. But the default time out is taken from the IIS. what is the security issue if ...
1
vote
1answer
94 views

Should Lockout Terminate The Session?

I think it is OK not to terminate existing sessions if user is locked out due to a number of login attempts with the wrong password. Because it might be an attack and it would be inconvenient to ...
5
votes
2answers
4k views

What is the security risk of enabling persistent connection (HTTP Keep-Alive)?

By my understanding, the HTTP Keep-Alive header dictates whether the next packet of communication will be sent over the same connection or not, i.e., if the web app runs over SSL, and a Keep-Alive is ...
0
votes
3answers
1k views

Storing session in querystring

I'm applying for a program through organization X's website. I logged in, and was astounded to find a URL like this: https://www.whatever.org/application?session=80_CHARACTER_HASH 80 characters in [...
3
votes
3answers
9k views

How do I store session data on a server securely

I'm building a system where security is important and I'd like to store session details on the server in a session table. However, I'm concerned that if an attacked got hold of the database, they ...
4
votes
1answer
278 views

Should Each Web Request Be Logged

I frequently see that logging the IP of the user is advised. I thought of attaching this information to the session record in the database but IP can change during the lifetime of a session. And if ...
14
votes
6answers
3k views

How can a user defend against session hijacking?

Given a website with various security flaws, one of them is session hijacking, session token continuously being sent as an argument over unsecured HTTP. In my field it's not surprising that others ...
0
votes
1answer
84 views

Protecting Session Authentication Tokens

I am creating a session authentication token and sending it to the client application. Any user data etc is associated to this token on the database, so the token does not contain any sensitive ...
2
votes
1answer
219 views

Is storing session data in the DMZ ok in an n-tier enterprise web application?

Say I have a standard multi-tier web application with web servers in the DMZ and multiple services only accessible from an authenticated web app. Also let's suppose the web app uses server-side ...
2
votes
1answer
896 views

Inducing TLS renegotiation

Is it possible to induce ssl renegotiation for a browser via command line / a curl request. I know it is possible to rate limit ssl renegotiation but do not know how to do it the other way around. I ...
4
votes
4answers
310 views

Causing Denial of Service by "Session Spaming"

Let's assume you have a single sign on ticket and you logon to a website which authanticates you by the ticket (same thing with user/password). The webserver will create a session and the user stores ...
2
votes
3answers
6k views

Is it safe to use session to check if the user is logged in?

I searched "how to check if user is logged in" and most of the answers that I found (on Stack Overflow) are to use PHP sessions. My questions are: Should I solely rely on PHP sessions to check if the ...
2
votes
2answers
362 views

Prevent session hijack on blog service?

I have a service where webmasters can create a website (including the use of javascript). A user can place a comment on the website of a webmaster. A user only needs to register and login once and ...
1
vote
0answers
356 views

Can a CSRF token be used as a session identifier instead of a cookie?

Someone has asked the same question here: Should CSRF token without session cookie work? but the people answering seem uncertain. So, why does anyone need a cookie at all if they are using a token ...
2
votes
5answers
4k views

Struggling to demonstrate/exploit a basic session hijack

As part of some basic pen-testing I've been invited to do on a live site, I've managed to access other users' cookies. The first thing that springs to mind that could be used to demonstrate the ...
-1
votes
1answer
81 views

Security mechanism for quick checkout (without cookies/session id)

I am implementing quick checkout in my e-store. Customer only have to enter email and phone number to make an order, system checks whether customer with such fields already registered, if not it ...
4
votes
1answer
7k views

How to securely store accesstoken in android

I have a web application which stores its accesstoken in localstorage. It also has an android application which is basically a webview wrapper of the web application. In this case, the local storage ...
2
votes
1answer
185 views

Is it a security risk that browsers can freely get images (and/or other resources) cross-domain?

Same origin policy protects us from malicious site manipulating the data on our trusted site by not allowing requests that would send the auth cookie e.g. But if I understand correctly images, scripts,...
1
vote
1answer
212 views

Is there any benefit to keep sending UN/PW to the server over Session ID ( i.e., Stateless vs Stateful)

I was reading this question about Session ID Hijacking and it gave a lot of answers about stealing Session IDs. I have been thinking about this for awhile, but is there a benefit to using Session ...
0
votes
2answers
3k views

Session Management: Set new value of session ID after privilege change and other sensitive operations

This OWASP Article on session management recommends to set a new value of session ID when: Common scenarios must also be considered, such as password changes, permission changes or switching from ...
1
vote
2answers
196 views

Is there an added risk in passing session token in message body?

We're working on a mobile app and are using session tokens for authentication with a back end server. Is it a security risk to pass the session token from the client to the server in the body? This ...
2
votes
1answer
76 views

Testing a black-box for sound authentication session config

How would I test that a website I'm successfully authenticated on (currently in session) has set my session ID in a safe way and isn't vulnerable? I believe a session ID should be obscured at the ...
30
votes
6answers
18k views

Can't a user change his session information to impersonate others?

Can't an attacker just change his/her session (or cookie because it's stored locally) information then fool the server that he's the legitimate user? Say for example, if a website uses the database ...
50
votes
4answers
13k views

Why aren't sessions exclusive to an IP address?

Given the appropriate XSS vulnerability, an attacker can hijack somebody's session with the data that's passed to and from the server. Why aren't sessions always exclusive to the IP they were started ...
4
votes
2answers
3k views

Why would the session ID entropy only be half of the length of the session ID?

On this page on the OWASP website, there is a sentence about session id entropy I find quite strange: The session ID value must provide at least 64 bits of entropy (if a good PRNG is used, this ...
2
votes
2answers
2k views

Comparing Session Hijacking, Fixation and Riding

How do I differentiate between these Session Hijacking/Session Fixation/Session Riding. I find it difficult to understand when read about all three at the same time. I get very confusion between when ...
5
votes
3answers
5k views

Should I also hash my session id before storing it in the database? [duplicate]

I'm writing an API that hands out session id's using PHP's uniqid function (yes using more entropy). However I'm wondering if it adds more security to hash this id on the server, just like the ...
6
votes
1answer
5k views

Sending session cookie inside the HTTP response body

It's known that the secure practice of setting a session cookie is using Set-Cookie header with Secure and HttpOnly flags. But is there any security issues with sending cookie inside the HTTP response ...
1
vote
1answer
857 views

insecure HTTP session issue

A java based application supports two user roles. Admin and nonAdmin. Login as Admin ,browser gets JSESSION ID. Login as nonAdmin user from another machine. Browser gets another JSESSION ID. Now ...
1
vote
2answers
38 views

allow user to delete individual sessions on account, safe to embed sessions in HTML?

I am currently building a web application that allows user to view all active sessions connected to their accounts, and if they want to, delete them individually - like Dropbox One way I want to ...
8
votes
2answers
6k views

Session cookie secure flag: best practice

There are 2 ways of setting 'secure' flag on a session cookie: In the application itself, for exemple: <session-config> <cookie-config> <http-only>true</http-only>...

1
3 4
5
6 7
11