83
votes
Accepted
Why aren't sessions exclusive to an IP address?
First, linking a session to an IP address will not make it secure since the server could see many different users as using the same IP address for various reasons (all types of proxy servers, for ...
- 18.7k
62
votes
Should concurrent logins be allowed?
There's no "one answer fits all" here. If it's simply a social media app, it might be sufficient to allow concurrent sessions, but also offer a way to terminate one or all sessions if the account is ...
- 5,734
57
votes
Accepted
Can't a user change his session information to impersonate others?
Yes, if you can guess another user's session key then you can become them. This is why you need to have a unpredictable session key that can be revoked.
There have been cases where best practice ...
- 1,649
40
votes
Accepted
Is there any point in setting the secure cookie flag for HSTS websites?
Yes, you should still mark your cookies as secure, for three reasons:
You dont want them to be exposed just because of a server configuration mishap. What if you move your application to a server ...
- 65.4k
29
votes
Accepted
What kind of hashing to use for storing REST API tokens in the database?
TLDR; SHA256 is good enough
To answer this we need to look at why we salt, hash, and use multiple iterations of the hash, in the first place;
Why do we salt? To protect users that have weak password ...
- 4,198
29
votes
Accepted
Why doesn't Tornado have session
I've heard that cookies is less secure than the session.
You must have misinterpreted something. In fact HTTP sessions are usually implemented using cookies.
I'm thinking that if I could get &...
- 198k
27
votes
Can't a user change his session information to impersonate others?
Yes. It can.
Session information is stored in server side (except the session token) while cookies in the other way are stored in the client side (browser). So the attacker might change the session ...
- 659
25
votes
Accepted
Is this a right technique to create and validate session tokens?
This approach is over-engineered. You don't need a checksum.
You have a database in which you can store session IDs associated with users. Use a cryptographically secure random number generator (...
- 135k
22
votes
Accepted
How can a user defend against session hijacking?
Here are some suggestions. None of this will give you the same level of security as TLS would, though.
Don't use the site unless you really have to. But since you ask, I assume you do.
If you visit ...
- 65.4k
21
votes
Accepted
Why do Firefox and Chrome "leak" critical security information out of the browser and how can I stop it?
Why do Firefox and Chrome allow such easy leaking of these session keys?
To make it easier for developers to analyze their network captures. The first time I used this feature was when trying to ...
- 6,078
20
votes
Can't a user change his session information to impersonate others?
There seems to be some confusion between cookeis and session information here, so lets start by sorting that out:
Cookies are stored on the client. The user can therefore change them if they want to.
...
- 65.4k
17
votes
What is the most secure way to store cross subdomain cookies
From RFC 6265:
5.1.3. Domain Matching
A string domain-matches a given domain string if at least one of the
following conditions hold:
o The domain string and the string are identical. (...
- 6,040
16
votes
Why aren't sessions exclusive to an IP address?
Back in the day, AOL was notorious for aggressively load-balancing traffic between its internal network and the Internet across all its exit proxies. This meant that a request for a single web page ...
- 34.6k
15
votes
On password change in a web application, should it log out all other sessions?
TL;DR: How do you know it's not the attacker who is changing the password? In that case, you would log out the legitimate user. Or a user might want to routinely change their password (a good practice)...
- 32.7k
14
votes
Is there any point in setting the secure cookie flag for HSTS websites?
Not all browsers honor HSTS. IE mobile doesn't, for example; desktop IE only does since version 11; cloud-based browsers like Opera Mini don't. Marking your cookies as secure is trivial and good ...
- 668
13
votes
How dangerous is storing the hashed password in local storage?
It's really dangerous.
The use of the local storage to store session identifiers is never recommended as the data is always accessible by JavaScript.
Please use Cookies to mitigate this risk using ...
- 874
12
votes
Should concurrent logins be allowed?
Concurrent logins should absolutely be allowed. Here's two concrete examples that should illustrate why:
Imagine if using iCloud/iMessage/Gmail/Google Drive on your computer caused your Apple or ...
11
votes
Why do banking websites always log you out after inactivity?
If your bank issues credit cards, it must maintain PCI-DSS compliance.
PCI-DSS requirement 8.1.8 states:
8.1.8 If a session has been idle for more than 15 minutes, require the user
to re-...
- 9,281
11
votes
Accepted
Security implications of not reusing SSL session in FTPS
There are potential issues with disabling session resumption for PASV mode FTP. These issues are solved by session resumption as it allows the server to know that the party that initiated the ...
- 66.5k
10
votes
Why aren't sessions exclusive to an IP address?
An attacker can connect to the server from the same address. For example an attacker and the victim are using the same WiFi.
Also, it can cause problems to the user if he/she has multiple routes to ...
- 1,791
10
votes
Accepted
Changing session id after login
The reason why it is best to change session ID's upon login is due to potential man-in-the-middle vulnerabilities. If an attacker captures your session ID, they can use it to pose as the legitimate ...
- 626
9
votes
Accepted
When should server side sessions be used instead of client side sessions?
For example, is it safe to put a csrf-token in a client side cookie, whether it is encrypted or not?
Yes. OWASP calls this method Double Submit Cookies. I have never seen it in practice though.
The ...
- 29.5k
9
votes
Accepted
Should I let the client send both the session and the user ID?
You are right that you need to make sure that your session ID's can not be brute forced. The trick is to make the session ID long and random (and when I say random, I mean securely random). If the ...
- 65.4k
9
votes
Accepted
Why sign session cookies?
Apparently, the software permits developers to provide their own session IDs, which (because people are often bad at security) might be short and/or predictable. The signature is thus added to create ...
- 46.4k
8
votes
Accepted
How long should a session absolute timeout be?
There is no strict answer to the time length. The limits of idle timeouts depend on regulations and possibly jurisdictional laws.
Session-based access to cardholder data in PCI DSS 3.1 is required ...
- 1,635
8
votes
Causing Denial of Service by "Session Spaming"
If you are using a good system for generating session IDs this would not be a problem. To prevent an attacker from guessing session IDs by brute forcing you need to have a very large space, so that ...
- 65.4k
8
votes
Why doesn't Tornado have session
I think the other answers fail to address the primary attack which is being protected against here, which is not forging the cookie, but tampering with it, or inspecting it.
If you send a cookie to a ...
- 3,860
7
votes
Is a session token enough for critical applications
If you use cookies to store session ID's just make sure it is set in a cookie with the Secure and HttpOnly attribute. Restrict the domain and path attributes as much as possible. Make sure no ...
- 1,820
7
votes
Why do Firefox and Chrome "leak" critical security information out of the browser and how can I stop it?
I think the answer to this questions can only be: If you want to turn it off, try to get involved with the developers, or compile your own version and remove the option there.
Suggestion: Turning on ...
- 547
7
votes
Why aren't sessions exclusive to an IP address?
Another reason against binding sessions to a specific IP address is a thing called "Happy eyeballs" (yes, really!).
It is basically a mechanism which tries to detect the best way of establishing a ...
- 171
Only top scored, non community-wiki answers of a minimum length are eligible