132 votes
Accepted

Session Authentication vs Token Authentication

In Session-based Authentication the Server does all the heavy lifting server-side. Broadly speaking a client authenticates with its credentials and receives a session_id (which can be stored in a ...
  • 2,705
82 votes
Accepted

Why aren't sessions exclusive to an IP address?

First, linking a session to an IP address will not make it secure since the server could see many different users as using the same IP address for various reasons (all types of proxy servers, for ...
  • 18.6k
62 votes

Why is it insecure to store the session ID in a cookie directly?

The author of that JS library seems to have made a common, yet mistaken, assumption, though based on just enough knowledge to get things wrong. You can't just sprinkle magik crypto faerie dust and ...
  • 72.1k
62 votes

Should concurrent logins be allowed?

There's no "one answer fits all" here. If it's simply a social media app, it might be sufficient to allow concurrent sessions, but also offer a way to terminate one or all sessions if the account is ...
  • 5,724
56 votes
Accepted

Can't a user change his session information to impersonate others?

Yes, if you can guess another user's session key then you can become them. This is why you need to have a unpredictable session key that can be revoked. There have been cases where best practice ...
  • 1,639
40 votes

Why do you need to close your browser window after logging out of a website?

After a bit of searching, it seems some banks are giving this advice following an attack on a bank that allowed users or malicious websites to reuse persistent cookies after a user had logged out, ...
40 votes
Accepted

Is there any point in setting the secure cookie flag for HSTS websites?

Yes, you should still mark your cookies as secure, for three reasons: You dont want them to be exposed just because of a server configuration mishap. What if you move your application to a server ...
  • 64.4k
29 votes
Accepted

Why doesn't Tornado have session

I've heard that cookies is less secure than the session. You must have misinterpreted something. In fact HTTP sessions are usually implemented using cookies. I'm thinking that if I could get &...
27 votes

Can't a user change his session information to impersonate others?

Yes. It can. Session information is stored in server side (except the session token) while cookies in the other way are stored in the client side (browser). So the attacker might change the session ...
  • 659
27 votes
Accepted

What kind of hashing to use for storing REST API tokens in the database?

TLDR; SHA256 is good enough To answer this we need to look at why we salt, hash, and use multiple iterations of the hash, in the first place; Why do we salt? To protect users that have weak password ...
  • 4,178
23 votes
Accepted

Is this a right technique to create and validate session tokens?

This approach is over-engineered. You don't need a checksum. You have a database in which you can store session IDs associated with users. Use a cryptographically secure random number generator (...
  • 132k
22 votes
Accepted

How can a user defend against session hijacking?

Here are some suggestions. None of this will give you the same level of security as TLS would, though. Don't use the site unless you really have to. But since you ask, I assume you do. If you visit ...
  • 64.4k
21 votes

Why is it insecure to store the session ID in a cookie directly?

A more complete answer from https://web.archive.org/web/20160306144238/http://hueniverse.com/2015/07/08/on-securing-web-session-ids/ Disclaimer: like any security advice from someone who doesn't know ...
19 votes
Accepted

Why do Firefox and Chrome "leak" critical security information out of the browser and how can I stop it?

Why do Firefox and Chrome allow such easy leaking of these session keys? To make it easier for developers to analyze their network captures. The first time I used this feature was when trying to ...
  • 5,898
19 votes

Can't a user change his session information to impersonate others?

There seems to be some confusion between cookeis and session information here, so lets start by sorting that out: Cookies are stored on the client. The user can therefore change them if they want to. ...
  • 64.4k
16 votes
Accepted

How is the session ID sent securely?

The connection between the client and the server does not use public key encryption (that is only used for the initial key exchange). A different algorithm is used for encryption (usually a symmetric ...
  • 8,217
15 votes

Why aren't sessions exclusive to an IP address?

Back in the day, AOL was notorious for aggressively load-balancing traffic between its internal network and the Internet across all its exit proxies. This meant that a request for a single web page ...
  • 34.4k
14 votes
Accepted

SSL/TLS Session Resumption with Session Tickets

If a client is compromised then that client is compromised. Session tickets don't change that one way or another... Session tickets are a TLS extension by which the server pushes the session context ...
14 votes
Accepted

Session Hijacking through sessionId brute-forcing possible?

Session Hijacking through sessionId brute-forcing possible? Probably not. owasp says that a session identifier should be at least 128 bit long to prevent session bruteforcing. They give these ...
  • 29k
14 votes

Why is it insecure to store the session ID in a cookie directly?

Eran Hammer, one of the maintainers of the yar session management module for NodeJS, had this to say on the matter: Disclaimer: like any security advice from someone who doesn't know the specifics of ...
  • 4,637
14 votes

Is there any point in setting the secure cookie flag for HSTS websites?

Not all browsers honor HSTS. IE mobile doesn't, for example; desktop IE only does since version 11; cloud-based browsers like Opera Mini don't. Marking your cookies as secure is trivial and good ...
  • 668
13 votes

How dangerous is storing the hashed password in local storage?

It's really dangerous. The use of the local storage to store session identifiers is never recommended as the data is always accessible by JavaScript. Please use Cookies to mitigate this risk using ...
  • 844
12 votes

On password change in a web application, should it log out all other sessions?

TL;DR: How do you know it's not the attacker who is changing the password? In that case, you would log out the legitimate user. Or a user might want to routinely change their password (a good practice)...
  • 32k
12 votes

What is the most secure way to store cross subdomain cookies

From RFC 6265: 5.1.3. Domain Matching A string domain-matches a given domain string if at least one of the following conditions hold: o The domain string and the string are identical. (...
  • 5,766
12 votes

Should concurrent logins be allowed?

Concurrent logins should absolutely be allowed. Here's two concrete examples that should illustrate why: Imagine if using iCloud/iMessage/Gmail/Google Drive on your computer caused your Apple or ...
10 votes

Why aren't sessions exclusive to an IP address?

An attacker can connect to the server from the same address. For example an attacker and the victim are using the same WiFi. Also, it can cause problems to the user if he/she has multiple routes to ...
  • 1,781
10 votes
Accepted

Security implications of not reusing SSL session in FTPS

There are potential issues with disabling session resumption for PASV mode FTP. These issues are solved by session resumption as it allows the server to know that the party that initiated the ...
  • 64.6k
9 votes

Web app with iframe and user - how to deal with session?

First, it's not a good idea as far as I know to put a secure application in an iframe because that expose you to security issue. The biggest one is probably clickjacking if all else is done correctly. ...
  • 6,921
9 votes

Why do banking websites always log you out after inactivity?

If your bank issues credit cards, it must maintain PCI-DSS compliance. PCI-DSS requirement 8.1.8 states: 8.1.8 If a session has been idle for more than 15 minutes, require the user to re-...
  • 9,101
9 votes

Session Authentication vs Token Authentication

HTTP is stateless, and in order to have an authenticated state, you need some kind of token used to reference information about the user. This session id is usually in the form of a random token ...
  • 46.9k

Only top scored, non community-wiki answers of a minimum length are eligible