Session management: Difference between revisions
ZosiaBurak (talk | contribs) |
ZosiaBurak (talk | contribs) |
||
| (5 intermediate revisions by the same user not shown) | |||
| Line 9: | Line 9: | ||
== Introduction == | == Introduction == | ||
is the process of securing multiple requests to a service from the same user or entity. In many cases, a session is initialized by authenticating a user or entity with factors such as a password. Once the user is authenticated, subsequent requests authenticate the session as opposed to the user themselves. | |||
== How does it work or a deeper look == | == How does it work or a deeper look == | ||
Session Id: Users prove they own a session by submitting authentication parameters with each request that typically include a session id and other factors such as a nonce. Session ids are designed to be long and random such that it is infeasible to guess them. | |||
Transport: Session management is essentially a process of providing secrets to authenticated users such as a session id and having them pass it back to you. As such, cryptographically secure network communications are required to implement secure session management. | |||
Cookies:The security of clients is a concern for session management. In the case of a web browser, session ids may be stored in secure cookies. In some cases, browsers can be tricked into giving up their session credentials with attacks such as DNS spoofing. As such, consideration of cookie security is within the scope of session management. | |||
Session Expiry: Sessions are designed to be temporary objects that expire. Their life is typically extended with each new request with a maximum age that can't be exceeded. | |||
Session Resources:Session management may be targeted by denial of service attacks that flood services with requests to create new sessions. As such, session management is ideally resource light. | |||
Detecting Anomalies:Session management may include features to detect anomalies such as brute force guesses of session ids or denial of service attacks.In some cases, session management may prevent users from creating multiple sessions from the same IP. For practical reasons of usability, this may be allowed up to some limit. | |||
== Examples == | == Examples == | ||
| Line 26: | Line 35: | ||
# [https://www.mediawiki.org/wiki/Help:Managing_files upload a file] | # [https://www.mediawiki.org/wiki/Help:Managing_files upload a file] | ||
# [https://www.mediawiki.org/wiki/Help:Images use the file on a wiki page] | # [https://www.mediawiki.org/wiki/Help:Images use the file on a wiki page] | ||
== References == | == References == | ||
| Line 40: | Line 40: | ||
<references /> | <references /> | ||
https://www.veracode.com/security/session-management | https://www.veracode.com/security/session-management | ||
https://simplicable.com/new/session-management | |||
[[Category:2019 case study]] | [[Category:2019 case study]] | ||
[[Category:Student created article]] | [[Category:Student created article]] | ||
Latest revision as of 10:36, 9 August 2018
This is student work which has not yet been approved as correct by the instructor
Introduction[edit]
is the process of securing multiple requests to a service from the same user or entity. In many cases, a session is initialized by authenticating a user or entity with factors such as a password. Once the user is authenticated, subsequent requests authenticate the session as opposed to the user themselves.
How does it work or a deeper look[edit]
Session Id: Users prove they own a session by submitting authentication parameters with each request that typically include a session id and other factors such as a nonce. Session ids are designed to be long and random such that it is infeasible to guess them.
Transport: Session management is essentially a process of providing secrets to authenticated users such as a session id and having them pass it back to you. As such, cryptographically secure network communications are required to implement secure session management.
Cookies:The security of clients is a concern for session management. In the case of a web browser, session ids may be stored in secure cookies. In some cases, browsers can be tricked into giving up their session credentials with attacks such as DNS spoofing. As such, consideration of cookie security is within the scope of session management.
Session Expiry: Sessions are designed to be temporary objects that expire. Their life is typically extended with each new request with a maximum age that can't be exceeded.
Session Resources:Session management may be targeted by denial of service attacks that flood services with requests to create new sessions. As such, session management is ideally resource light.
Detecting Anomalies:Session management may include features to detect anomalies such as brute force guesses of session ids or denial of service attacks.In some cases, session management may prevent users from creating multiple sessions from the same IP. For practical reasons of usability, this may be allowed up to some limit.
Examples[edit]
Please include some example of how your concept is actually used. Your example must include WHERE it is used, and WHAT IS BENEFIT of it being used.
Pictures, diagrams[edit]
Pictures and diagrams go a LONG way to helping someone understand a topic. Especially if your topic is a little abstract or complex. Using a picture or diagram is a two part process: