Contents
What is a session token what is it used for?
The session token, also known as a sessionID, is an encrypted, unique string that identifies the specific session instance. If the session token is known to a protected resource such as an application, the application can access the session and all user information contained in it.
Should session tokens be hashed?
It’s really easy to run a quick SHA-2 on the session token, so if there’s any chance that either #1, #2 or #3 will be implemented down the road, then go for it! It is a good to have feature but not absolutely mandatory.
How long should a session token be?
Session identifiers should be at least 128 bits long to prevent brute-force session guessing attacks.
How are session tokens transmitted?
There are different ways to share session tokens. They are most commonly included in cookies but alternative methods are quite widespread as well. Such methods include sending the session tokens directly in URLs, in dynamically rewritten URLs, or hidden in the HTML source of the web page.
What do you need to know about user session security?
To keep tokens safe, a system architect should not only prevent tokens from being stolen but, as a fail-safe, also ensure that should token theft occur, the system is able to detect it as quickly as possible. Detection is an important concept to consider and will be explored in the next section.
Where are authentication tokens stored in an application?
First, let’s talk about applications which are implemented with stateful authentication. The authentication state in these applications is just a simple file (or data/record) that’s stored in temporary storage. In addition to the file, users get an identification (or session) token.
How can I revoke a user session token?
However, one can revoke all tokens by changing the signing key. These are random strings which act as pointers to information that is held only by the system that issues them. These require a database/cache lookup each time they are used. A single token can easily be revoked on demand.
When does the critical auth token expire?
The critical auth token is perpetually exposed over three attack surfaces — the frontend, during transit and the backend. The attacker would have unauthorised access to the victim’s account until the token’s expiry time — which could be weeks or months!