Sciweavers

ESORICS
2006
Springer

SessionSafe: Implementing XSS Immune Session Handling

13 years 7 months ago
SessionSafe: Implementing XSS Immune Session Handling
With the growing trend towards the use of web applications the danger posed by cross site scripting vulnerabilities gains severity. The most serious threats resulting from cross site scripting vulnerabilities are session hijacking attacks: Exploits that steal or fraudulently use the victim's identity. In this paper we classify currently known attack methods to enable the development of countermeasures against this threat. By close examination of the resulting attack classes, we identify the web application's characteristics which are responsible for enabling the single attack methods: The availability of session tokens via JavaScript, the pre-knowledge of the application's URLs and the implicit trust relationship between webpages of same origin. Building on this work we introduce three novel server side techniques to prevent session hijacking attacks. Each proposed countermeasure removes one of the identified prerequisites of the attack classes. SessionSafe, a combinatio...
Martin Johns
Added 22 Aug 2010
Updated 22 Aug 2010
Type Conference
Year 2006
Where ESORICS
Authors Martin Johns
Comments (0)