The Community for Technology Leaders
RSS Icon
Subscribe
Issue No.01 - January/February (2011 vol.15)
pp: 88-91
Stephen Farrell , Trinity College Dublin
ABSTRACT
Many Internet and Web applications use session identifiers. Too often, developers of those applications make the bad assumption that all is well because session identifiers are only known to authorized users. However, in many cases, session identifiers can leak out or be guessed, sometimes trivially. If presenting an identifier is the only authorization an application requires, it can represent an easily exploited vulnerability. Although these vulnerabilities are old and well-known, some recent examples of problems arising from them show that developers must remain on guard against them.
INDEX TERMS
session identifier security, brute-force, guessing, information leakage
CITATION
Stephen Farrell, "Leaky or Guessable Session Identifiers", IEEE Internet Computing, vol.15, no. 1, pp. 88-91, January/February 2011, doi:10.1109/MIC.2011.12
21 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool