Secure Authentication and Session Management
summary
Four live demos show session IDs leaking in URLs and cookies, hijacking via tcpdump and a browser cookie manager, XSS exfiltration using an image src to send document.cookie to a servlet, and CSRF via an auto-submitted hidden form; Twitter is used to distribute exploit links and network issues partially break demos. Concrete fixes: set web.xml tracking-mode to cookies, use HTTPOnly flag and Secure flag, call changeSessionId() after login (or regenerate and copy attributes), use ≥16‑char random IDs, short timeouts (2–5 min for critical).
AI-written summary · about
chapters (15)
- 0:00Start
- 0:29About Me
- 1:07Agenda
- 3:07Security Stories 2014/2015.
- 4:04What is Web Session? JAVADAY
- 4:45OWASP Top 10 Risks
- 8:05Demo: Session Exposed in URDAY
- 24:12Demo: Session Sniffing JAY
- 24:35How to Avoid Session Exposure During Transport?
- 24:46web.xml
- 27:59How to Steal a Session it Transport Is Used?
- 36:41Session Fixation: ScenarioDA
- 38:00Session Fixation: Solution
- 43:27What If We Can't Steal a Cookie?
- 48:51Conclusion
related talks
52mSecure Authentication and Session Management in Java EE
52mSecure Authentication and Session Management in Java EE
28mCookie Crumbles: Unveiling Web Session Integrity Vulnerabilities
42mSession Security in Web Applications
01h 04mWeb Security And You
31mHow to Protect Yourself Against XSS Attacks in Java
42mModern web application bugs
21mDeath to Cookies