Уровень 0 · материалов: 3
Документы должны касаться механизмов и способов предотвращения несанкционированного захвата пользовательских сессий.
Общие признаки: перехват сессий (session hijacking), безопасность аутентификации, уязвимости веб-приложений
Группа выше: Перехват сессий и атаки на исчерпание ресурсов
Смысл: The main idea is to warn developers against 'Session Fixation' vulnerabilities, where a server accepts a session ID provided by the client during login, allowing attackers to hijack accounts.
The author reveals a session fixation vulnerability on Habr where reusing a client-provided session ID allows for remote account hijacking.
Смысл: The main idea is to warn users about the vulnerability of session hijacking through tools like The Middler when HTTPS is not enforced throughout the entire session, emphasizing the necessity of enabling 'Always use https' in Gmail and similar services.
The Middler is a Ruby-based tool that steals session cookies from users who don't enforce HTTPS, highlighting a critical security flaw in how some services handle encrypted connections.
Смысл: The main idea is to describe the transition from a shared single-sign-on session to a segregated session architecture to limit the blast radius of security vulnerabilities like XSS and session hijacking.
Mail.Ru replaced its global session cookie with a system of subdomain-specific cookies to prevent a security breach in one service from compromising the user's entire account across the portal.