Skip to main content
Share Your Experience: Take the 2024 Developer Survey
83 votes
Accepted

Why aren't sessions exclusive to an IP address?

First, linking a session to an IP address will not make it secure since the server could see many different users as using the same IP address for various reasons (all types of proxy servers, for ...
Stephane's user avatar
  • 18.7k
63 votes

Should concurrent logins be allowed?

There's no "one answer fits all" here. If it's simply a social media app, it might be sufficient to allow concurrent sessions, but also offer a way to terminate one or all sessions if the account is ...
phyrfox's user avatar
  • 5,724
57 votes
Accepted

Can't a user change his session information to impersonate others?

Yes, if you can guess another user's session key then you can become them. This is why you need to have a unpredictable session key that can be revoked. There have been cases where best practice ...
Topher Brink's user avatar
  • 1,639
40 votes
Accepted

Is there any point in setting the secure cookie flag for HSTS websites?

Yes, you should still mark your cookies as secure, for three reasons: You dont want them to be exposed just because of a server configuration mishap. What if you move your application to a server ...
Anders's user avatar
  • 65.6k
31 votes
Accepted

What kind of hashing to use for storing REST API tokens in the database?

TLDR; SHA256 is good enough To answer this we need to look at why we salt, hash, and use multiple iterations of the hash, in the first place; Why do we salt? To protect users that have weak password ...
Hybrid's user avatar
  • 4,228
29 votes
Accepted

Why doesn't Tornado have session

I've heard that cookies is less secure than the session. You must have misinterpreted something. In fact HTTP sessions are usually implemented using cookies. I'm thinking that if I could get &...
Steffen Ullrich's user avatar
27 votes

Can't a user change his session information to impersonate others?

Yes. It can. Session information is stored in server side (except the session token) while cookies in the other way are stored in the client side (browser). So the attacker might change the session ...
Vini7's user avatar
  • 659
25 votes
Accepted

Is this a right technique to create and validate session tokens?

This approach is over-engineered. You don't need a checksum. You have a database in which you can store session IDs associated with users. Use a cryptographically secure random number generator (...
Polynomial's user avatar
  • 135k
22 votes
Accepted

How can a user defend against session hijacking?

Here are some suggestions. None of this will give you the same level of security as TLS would, though. Don't use the site unless you really have to. But since you ask, I assume you do. If you visit ...
Anders's user avatar
  • 65.6k
20 votes

Can't a user change his session information to impersonate others?

There seems to be some confusion between cookeis and session information here, so lets start by sorting that out: Cookies are stored on the client. The user can therefore change them if they want to. ...
Anders's user avatar
  • 65.6k
18 votes

What is the most secure way to store cross subdomain cookies

From RFC 6265: 5.1.3. Domain Matching A string domain-matches a given domain string if at least one of the following conditions hold: o The domain string and the string are identical. (...
Ghedipunk's user avatar
  • 6,050
16 votes

On password change in a web application, should it log out all other sessions?

TL;DR: How do you know it's not the attacker who is changing the password? In that case, you would log out the legitimate user. Or a user might want to routinely change their password (a good practice)...
Luc's user avatar
  • 32.9k
16 votes

Why aren't sessions exclusive to an IP address?

Back in the day, AOL was notorious for aggressively load-balancing traffic between its internal network and the Internet across all its exit proxies. This meant that a request for a single web page ...
Mark's user avatar
  • 34.7k
14 votes

Is there any point in setting the secure cookie flag for HSTS websites?

Not all browsers honor HSTS. IE mobile doesn't, for example; desktop IE only does since version 11; cloud-based browsers like Opera Mini don't. Marking your cookies as secure is trivial and good ...
Tgr's user avatar
  • 668
13 votes

How dangerous is storing the hashed password in local storage?

It's really dangerous. The use of the local storage to store session identifiers is never recommended as the data is always accessible by JavaScript. Please use Cookies to mitigate this risk using ...
jmingov's user avatar
  • 874
12 votes

Should concurrent logins be allowed?

Concurrent logins should absolutely be allowed. Here's two concrete examples that should illustrate why: Imagine if using iCloud/iMessage/Gmail/Google Drive on your computer caused your Apple or ...
Joseph Sible-Reinstate Monica's user avatar
11 votes

Why do banking websites always log you out after inactivity?

If your bank issues credit cards, it must maintain PCI-DSS compliance. PCI-DSS requirement 8.1.8 states: 8.1.8 If a session has been idle for more than 15 minutes, require the user to re-...
John Wu's user avatar
  • 9,301
11 votes
Accepted

Security implications of not reusing SSL session in FTPS

There are potential issues with disabling session resumption for PASV mode FTP. These issues are solved by session resumption as it allows the server to know that the party that initiated the ...
forest's user avatar
  • 66.8k
10 votes

Why aren't sessions exclusive to an IP address?

An attacker can connect to the server from the same address. For example an attacker and the victim are using the same WiFi. Also, it can cause problems to the user if he/she has multiple routes to ...
one's user avatar
  • 1,821
10 votes
Accepted

Changing session id after login

The reason why it is best to change session ID's upon login is due to potential man-in-the-middle vulnerabilities. If an attacker captures your session ID, they can use it to pose as the legitimate ...
Henry F's user avatar
  • 626
10 votes
Accepted

Why sign session cookies?

Apparently, the software permits developers to provide their own session IDs, which (because people are often bad at security) might be short and/or predictable. The signature is thus added to create ...
CBHacking's user avatar
  • 48.9k
9 votes
Accepted

Should I let the client send both the session and the user ID?

You are right that you need to make sure that your session ID's can not be brute forced. The trick is to make the session ID long and random (and when I say random, I mean securely random). If the ...
Anders's user avatar
  • 65.6k
8 votes

Why aren't sessions exclusive to an IP address?

Another reason against binding sessions to a specific IP address is a thing called "Happy eyeballs" (yes, really!). It is basically a mechanism which tries to detect the best way of establishing a ...
Manawyrm's user avatar
  • 181
8 votes

Causing Denial of Service by "Session Spaming"

If you are using a good system for generating session IDs this would not be a problem. To prevent an attacker from guessing session IDs by brute forcing you need to have a very large space, so that ...
Anders's user avatar
  • 65.6k
8 votes
Accepted

Session hijacking mitigation

This would be effective against session hijacking. It would also log out users when they resize their browser window, or when they update their browser. The best way to prevent session hijacking is to ...
Sjoerd's user avatar
  • 30.8k
8 votes

Why doesn't Tornado have session

I think the other answers fail to address the primary attack which is being protected against here, which is not forging the cookie, but tampering with it, or inspecting it. If you send a cookie to a ...
IMSoP's user avatar
  • 3,900
8 votes

How do big websites (e.g. Google, Twitter, GitHub, ...) have practically infinite session lengths without compromising on security?

No, the bigger comapny do not prioritize user experience over security. Rather, they strive to provide a good balance between user experience and security. While long session lengths improve user ...
Rudra Sarkar's user avatar
7 votes

Better security - Session ID in cookies vs. Encrypted cookie

The security difference will mostly be in the implementation details. Fundamentally both approaches are the same: you store a blob of data which is meaningless to the client on the client to preserve ...
deceze's user avatar
  • 715
7 votes

Does user-agent session tracking provide any benefit?

Including the user-agent in the session provides some rudimentary protection against session hijacking. This means if the attacker somehow got access to the session cookie he cannot just simply use ...
Steffen Ullrich's user avatar
7 votes
Accepted

JWT or session cookie for API for both web and mobile app?

Before going into the details I will say that both session cookies and JWTs work for your case and both are secure if implemented correctly. Personally I would go with JWTs if only because it's easier ...
AlphaD's user avatar
  • 923

Only top scored, non community-wiki answers of a minimum length are eligible