Skip to main content

New answers tagged

-1 votes

How to protect the Session ID?

The alternet way is to use RSA encrypted unique value which can only be assigned to user and less essential in local storage and session , decrypt the same and validate it with the session for all the ...
Bhargav Patel's user avatar
1 vote

Deciding whether user has left the site without logging out or has simply left the site open for notifications without actually doing any work?

I think things have evolved quite a bit since the original answers. In general, my suggestion is to not log the user out unless absolutely necessary (policy), explicitly requested, or in a context ...
multithr3at3d's user avatar
3 votes

Do browsers like FireFox, Chrome, Opera, and Tor store TLS 1.3 session tickets on the disk?

How and where the client stores the TLS session ticket is not critical, as TLS session tickets are generally not secrets. As explained in section 3.1 of RFC 5077: When the client wishes to resume ...
mti2935's user avatar
  • 23.7k
3 votes
Accepted

Besides checking whether the session ID is valid, what other things should we check in order to prevent session ID leakage?

I'm thinking of checking the device fingerprint and whether the IP address is in the trusted IPs list. Some applications bind the session to the user's IP address or user agent. However, this is ...
Sjoerd's user avatar
  • 31.8k

Top 50 recent answers are included