I've been using session middleware to build web apps for years: from PHP's built-in session handling layer to node's connect session middleware. However, I've never tried (or needed) to roll my own session handling layer. How would one go about it? What sort of checks are necessary to provide at least some modicum of security against HTTP session highjacking?

I figure setting a cookie with a token to keep track of the session, and then perhaps some check to see that the originating IP address of the session doesn't change and that the client browser software remains consistent. Hoping to hear about current best-practices...

  • 1
    IP addresses change constantly - I switch between Wifi and mobile networks as I go and expect services to continue etc. and simulating HTTP headers to claim to be the same browser is the first thing an attacker does ;-) – johannes Jun 10 '14 at 15:51
  • Good point @johannes. How then to provide some basic protection against session high jacking? Or does that all rest on just the cookie that must be kept private? – b.b. Jun 10 '14 at 16:12
  • Use http only sessions (no javascript based exploits that easily), use https (harder to intercept cookie), regenerate often (short time frame for attacker) – johannes Jun 10 '14 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.