Emerging Trends in ICT Security: Chapter 29. Improving Security in Web Sessions: Special Management of Cookies (Emerging Trends in Computer Science and Applied Computing)

The current mechanism implemented for Web session management implies exchanging session cookies between a Web application client (usually a browser) and a Web application server. Besides having privacy issues, the security of Web sessions can be affected by various reasons related to cookies. There are several vulnerabilities that threaten a Web application specifically related to cookies: theft, tampering, and/or forgery. Any of these vulnerabilities may favor session theft and/or unauthorized access using the identity of another user in the system. In this chapter, we present an alternative technique for management of Web sessions, where no session cookies are sent to clients while maintaining backward compatibility. As a result, the proposed technique is shown to avoid several specific vulnerabilities that affect the security of Web application sessions and users. The proposed mechanism works transparently for Web applications, and a proof of concept was successfully tested with Web applications based on different languages such as Php, Perl, Ruby, and Python.