SecurityPreview
Open in TheBrain

Poor session management

Let’s assume you like playing online games. You log in to the application and make several interactions with the network.

The application issues a session ID whenever you log in and records all your interactions. It is through this ID that the application communicates with you and responds to all your requests.

The OWASP broken authentication recommendations state that this session ID is equivalent to your original login credentials. If hackers steal your session ID, they can sign in by impersonating your identity. This is known as session hijacking.

The following points list the scenarios that can cause broken authentication.

  1. Weak usernames and passwords.
  2. Session fixation attacks.
  3. URL rewriting.
  4. Consumer identity details aren't protected when stored.
  5. Consumer identity details are transferred over unencrypted connections.