1 / 7

Preventing Session Hijacking: Secure Your Web Application Sessions

Learn about session hijacking, the risks, prevention methods, and why session identifiers should be unique, secure, and managed properly. Discover best practices and the importance of maintaining client-side and server-side security.

reden
Télécharger la présentation

Preventing Session Hijacking: Secure Your Web Application Sessions

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Session Hijacking Tarun Lall

  2. What is Session Hijacking • TCP Connection Takeover • Takeover of a Web Application Session

  3. State Management • HTTP is Stateless • Web Applications need state • User Logins • Shopping Carts

  4. State Management, Cont’d • Client Side • Server Side • Golden Rule of Web Application Security • Cookies and Hidden Fields

  5. Reasons for Session Hijacking • No Standards for Maintaining State • Session Tracking and State information at Client

  6. How to Prevent Session Hijacking • Session Identifiers Should Be Unique • Session Identifiers Should Not be Guessable • Session Identifiers Should Be Independent • Session Identifiers Should be Mapped with Client-Side Connections

  7. References • Web hacking Attacks and Defense by Stuart McClure, Saumil Shah, Shreeraj Shah • http://www.ftponline.com/javapro/2004_01/magazine/columns/proshop/default_pf.aspx • http://www.iss.net/security_center/advice/Exploits/TCP/session_hijacking/default.htm • http://staff.washington.edu/dittrich/talks/qsm-sec/script.html

More Related