New answers tagged

1 vote
Accepted

How do I handle working with/updating sessions?

There is no universally “correct” way of implementing session expiration. You'll have to find a reasonable balance between security and usability for the specific application. The reason why the ...
Ja1024's user avatar
  • 4,258
1 vote

Can I set session time to 10 days without risking security issues?

is there any security risk to doing this? If your application is used from a business where people lock their computers, there's negligible risk in having longer session timeouts. If your application ...
Sjoerd's user avatar
  • 30.4k
1 vote

Can I set session time to 10 days without risking security issues?

Setting a long session duration isn't inherently insecure. The reason why sessions are typically short-lived is because many applications do use them for user authentication, and in this case, the ...
Ja1024's user avatar
  • 4,258
1 vote
Accepted

Double Submit Cookie Bypass

There seem to be some confusions with regards to the double-submit pattern and cookies in general. First off, when attacker.com triggers a request to victim.com, the browser may very well include ...
Ja1024's user avatar
  • 4,258

Top 50 recent answers are included