Session management: Difference between revisions
ZosiaBurak (talk | contribs) |
ZosiaBurak (talk | contribs) |
||
| Line 13: | Line 13: | ||
== How does it work or a deeper look == | == How does it work or a deeper look == | ||
Session Id: Users prove they own a session by submitting authentication parameters with each request that typically include a session id and <br> | |||
other factors such as a nonce. Session ids are designed to be long and random such that it is infeasible to guess them. | |||
Transport: Session management is essentially a process of providing secrets to authenticated users such as a session id and having them pass it | |||
back to you. As such, cryptographically secure network communications are required to implement secure session management. | |||
Cookies: The security of clients is a concern for session management. In the case of a web browser, session ids may be stored in secure | |||
cookies. In some cases, browsers can be tricked into giving up their session credentials with attacks such as DNS spoofing. As such, | |||
consideration of cookie security is within the scope of session management. | |||
Session Expiry: Sessions are designed to be temporary objects that expire. Their life is typically extended with each new request with a maximum | |||
age that can't be exceeded. | |||
Session Resources: Session management may be targeted by denial of service attacks that flood services with requests to create new sessions. As | |||
such, session management is ideally resource light. | |||
== Examples == | == Examples == | ||
Revision as of 10:33, 9 August 2018
This is student work which has not yet been approved as correct by the instructor
Introduction[edit]
is the process of securing multiple requests to a service from the same user or entity. In many cases, a session is initialized by authenticating a user or entity with factors such as a password. Once the user is authenticated, subsequent requests authenticate the session as opposed to the user themselves.
How does it work or a deeper look[edit]
Session Id: Users prove they own a session by submitting authentication parameters with each request that typically include a session id and
other factors such as a nonce. Session ids are designed to be long and random such that it is infeasible to guess them.
Transport: Session management is essentially a process of providing secrets to authenticated users such as a session id and having them pass it
back to you. As such, cryptographically secure network communications are required to implement secure session management.
Cookies: The security of clients is a concern for session management. In the case of a web browser, session ids may be stored in secure
cookies. In some cases, browsers can be tricked into giving up their session credentials with attacks such as DNS spoofing. As such,
consideration of cookie security is within the scope of session management.
Session Expiry: Sessions are designed to be temporary objects that expire. Their life is typically extended with each new request with a maximum
age that can't be exceeded.
Session Resources: Session management may be targeted by denial of service attacks that flood services with requests to create new sessions. As
such, session management is ideally resource light.
Examples[edit]
Please include some example of how your concept is actually used. Your example must include WHERE it is used, and WHAT IS BENEFIT of it being used.
Pictures, diagrams[edit]
Pictures and diagrams go a LONG way to helping someone understand a topic. Especially if your topic is a little abstract or complex. Using a picture or diagram is a two part process:
External links[edit]
- It would be helpful
- to include many links
- to other internet resources
- to help fellow students
- Please make sure the content is good
- and don't link to a google search results, please