Contents
What can we do with session ID?
As session IDs are often used to identify a user that has logged into a website, they can be used by an attacker to hijack the session and obtain potential privileges. A session ID is usually a randomly generated string to decrease the probability of obtaining a valid one by means of a brute-force search.
How can the session IDs be transferred in an application?
The best method to send a session ID is to embed the session ID in a cookie….Transmitting Session IDs
- Sending the session ID in plain text in the URL.
- Sending hashed session ID in the URL.
- Sending the session ID as a hidden value in the form.
- Embed the session ID in the Cookie.
Is it safe to expose session information in the URL?
Exposing session information in the URL is a growing security risk (from place 7 in 2007 to place 2 in 2013 on the OWASP Top 10 List). Starting with Spring 3.0, the URL rewriting logic that would append the jsessionid to the URL can now be disabled by setting the disable-url-rewriting=”true” in the namespace.
What happens if my session ID is expired?
After the session has timed out, if the user sends a request with an expired session id, they will be redirected to a URL configurable via the namespace: Similarly, if the user sends a request with a session id which is not expired, but entirely invalid, they will also be redirected to a configurable URL:
Why is passing the session ID as URL parameter insecure?
If a site uses HTTP mixed with HTTPS, the id would be transmitted plaintext in the URL for all HTTP requests (even for an image request). So if the attacker can read a single HTTP request after the user has logged in, he knows the session id. A way out of the problem would be to separate the two concerns,…
Is it safe to expose a database ID?
Otherwise the URL itself should be secret. EDIT: if the URL is secret, it will probably contain a generated token that has a limited lifetime, e.g. valid for 1 hour and can only be used once. EDIT (months later): my current preferred practice for this is to use UUIDS for IDs and expose them.