.png){kind=icon}
.png){kind=icon}
Return
Measuring Web Session Security at Scale
.png){kind=icon}
OA
AI
DOI：10.1016/j.cose.2021.102472.png)
.png){kind=icon}
.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Session management is a particularly delicate component of web applications, which might suffer from a range of severe security issues, including impersonation attacks. Unfortu-nately, the scope and significance of prior work on web session security in the wild are limited by the complexity of the attack surface and the challenges of automating the lo-gin process on existing websites. In the present article, we fill this gap by proposing the first comprehensive, large-scale web session security measurement based on post-login data. Our analysis is comprehensive in that it deals with all key aspects of web sessions, i.e., the lo-gin process, the logout process and the authentication cookie handling. Our automated ap-proach analysed an extensive set of session management practices of over 6,000 sites where login was successful and authentication cookies could be automatically detected, uncover-ing a widespread adoption of insecure practices in the wild. (c) 2021 Elsevier Ltd. All rights reserved.
Keywords:
Session security
Shepherd
Black-box testing
Web measurements
Automated login
Authentication
AI Summary
Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W