Leaky or Guessable Session Identifiers
Citation:
Stephen Farrell, Leaky or Guessable Session Identifiers, IEEE Internet Computing, 15, 1, 2011, 88-91Download Item:
Abstract:
Many Internet and Web applications use session identifiers. Too often, developers of those applications make the bad assumption that all is well because session identifiers are only known to authorized users. However, in many cases, session identifiers can leak out or be guessed, sometimes trivially. If presenting an identifier is the only authorization an application requires, it can represent an easily exploited vulnerability. Although these vulnerabilities are old and well-known, some recent examples of problems arising from them show that developers must remain on guard against them.
Author's Homepage:
http://people.tcd.ie/sfarrel6Description:
PUBLISHED
Author: FARRELL, STEPHEN
Publisher:
IEEEType of material:
Journal ArticleCollections
Series/Report no:
IEEE Internet Computing;15;
1;
Availability:
Full text availableKeywords:
Computer sciences, Network securityMetadata
Show full item recordLicences: