A 2 3 Session Session Session Session You have invented a new attack (no card) William has control over the Ryan can use a single account in against Session Management generation of session identifiers parallel since concurrent sessions are allowed Management Management Management Management Read more about this topic in OWASP’s free Cheat Sheets on Session Management, and Cross Site Request Forgery (CSRF) Prevention 4 5 6 7 Session Session Session Session Alison can set session John can predict or guess session Gary can take over a user's Casey can utilize Adam's session identification cookies on another identifiers because they are not session because there is a long or after he has finished, because web application because the changed when the user's role no inactivity timeout, or a long or there is no log out function, or he Management Management Management Management domain and path are not alters (e.g. pre and post no overall session time limit, or cannot easily log out, or log out restricted sufficiently authentication) and when the same session can be used does not properly terminate the switching between non-encrypted from more than one session and encrypted communications, device/location or are not sufficiently long and random, or are not changed periodically
Session Management A Session Management Session Management 2 Session Management 3 You have invented a new attack against Session Management (no card) William has control over the generation of session identifiers Ryan can use a single account in parallel since concurrent sessions are allowed Read more about this topic in OWASP’s free Cheat Sheets on Session Management, and Cross Site Request Forgery (CSRF) Prevention Session Management 4 Session Management 5 Session Management 6 Session Management 7 Alison can set session identification cookies on another web application because the domain and path are not restricted sufficiently John can predict or guess session identifiers because they are not changed when the user's role alters (e.g. pre and post authentication) and when switching between non-encrypted and encrypted communications, or are not sufficiently long and random, or are not changed periodically Gary can take over a user's session because there is a long or no inactivity timeout, or a long or no overall session time limit, or the same session can be used from more than one device/location Casey can utilize Adam's session after he has finished, because there is no log out function, or he cannot easily log out, or log out does not properly terminate the session
20130918180752%21OWASP-Cornucopia-Ecommerce_Website.docx