Jaime can bypass authentication Olga can influence or alter (no card) (no card) because it is not enforced authentication code/routines so comprehensively across all entry they can be bypassed points, modules, functions, content and other data, or is not applied with equal rigor for all types of authentication functionality (e.g. register, password change, password change, log out, administration) A 2 3 Session Session Session Session You have invented a new attack (no card) William has control over the Ryan can use a single account in against Session Management generation of session identifiers parallel since concurrent sessions are allowed Management Management Management Management Read more about this topic in OWASP’s free Cheat Sheets on Session Management, and Cross Site Request Forgery (CSRF) Prevention 4 5 6 7
Jaime can bypass authentication because it is not enforced comprehensively across all entry points, modules, functions, content and other data, or is not applied with equal rigor for all types of authentication functionality (e.g. register, password change, password change, log out, administration) Olga can influence or alter authentication code/routines so they can be bypassed (no card) (no card) Session Management A Session Management Session Management 2 Session Management 3 You have invented a new attack against Session Management (no card) William has control over the generation of session identifiers Ryan can use a single account in parallel since concurrent sessions are allowed Read more about this topic in OWASP’s free Cheat Sheets on Session Management, and Cross Site Request Forgery (CSRF) Prevention 4 5 6 7
20130225130129%21OWASP-Cornucopia-Ecommerce_Website.docx