Re: Problem while using cookieless session

From: Cactus Corp. (nXewsXalaXksaX_at_nXxtg.XnetX)
Date: 08/16/05 

Date: Tue, 16 Aug 2005 17:03:20 +0200

> We are facing problems while using cookieless session. When the user copies
> and pastes the url from one machine to another, he is able to access the data
> entered by the first user. Is there any way to eliminate this problem.
>
> Thanks in advance.

Hello ,

The session identifier is used to identify which session the visitor is linked to.
As it sounds....

Consequently , if someone does a copy/paste of one of your cookie-less
URLs, he gets access to your session.

The role of the SESSIONID is to establish the link : this is an identification
process. What you're looking for is an authentication process : after identifying
which session is requested, you want the application to make sure nobody is
usurpating an identity.

You need to add a few checks to make sure of this. There are many discussions
about that , the term used by many security professionals is "session hijacking".

For example :
    - adding secure tokens to your urls
    - IP address to session-id link
    - challenged URLs
    - ...and so on...

Good luck!

Antonio

Relevant Pages

  • Re: Problem while using cookieless session
    ... Is there any way to hide the session id displayed in the URL? ... Can you suggest any alternate solution?As we could find only usage of hidden ... > Dominick Baier - DevelopMentor ... >> We are facing problems while using cookieless session. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: session related issue
    ... Since the Session ends on the server side, the client can do a redirect as ... in my application i am facing problems in maintaining session state. ...
    (microsoft.public.dotnet.framework.aspnet)
  • session related issue
    ... in my application i am facing problems in maintaining session state. ... So i didnt checked the session on each page and almost the project is ... (Though i can increase the session timeout period but i dont want ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: The concept of using your own SessionID
    ... I may not have completely taken in what Aaron ... > his/her http pandemonium to try and hack other people's sessions. ... whereas the in-built session ID can be relatively invisible. ... some form of randomized identifier, whether that be the random auto-number ...
    (microsoft.public.inetserver.asp.db)
  • Re: The concept of using your own SessionID
    ... > Just been looking through the excellent ASPFaq site and wanted to dissucss ... > his/her http pandemonium to try and hack other people's sessions. ... whereas the in-built session ID can be relatively invisible. ... some form of randomized identifier, whether that be the random auto-number ...
    (microsoft.public.inetserver.asp.db)