Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

One of the fundamental ways of handling user login authentication & session management is by storing variables in Session space plus setting some data in cookies on client computer while sometimes in database as well.

I have been using this simpler technique in many of my academic as well as a few online projects. But I am a little unsure about it.

Do security critical websites like Amazon, Gmail or Facebook use the very same technique for user login & session management or is there more to it than I have known?

This could turn out to be a very general question but I'd really like to know if there are other or mix of multiple ways used (like at gmail, stackexchange or myspace) for handling user login authentication & session management in particular.

share|improve this question
    
authentication and authorization isn't same. –  Dainius Jul 17 '13 at 8:31
    
my question pertains to authentication –  tGilani Jul 17 '13 at 9:33
add comment

1 Answer

If you use any of those sites, look at your browser's cookie store - you'll see that they're doing exactly what you ask.

The main issues with cookies and security are that they're stored on the client machine and transmitted back and forth to the server - so you don't want to be storing important information (such as user passwords)!

Consider using HTTPS to make session fixation attacks (where an attacker sniffs the session ID as the client transmits it to the server and uses that to masquerade as the client) a bit more difficult; in a number of cases (Facebook uses extra steps to confirm your identity if you use a new IP address, the Bugzilla/Mantis bug trackers both ask you to login again), sessions are invalidated if some other identifying feature such as IP address changes and sessions can have a timeout which can also reduce the value of stealing the session ID.

Lastly, since they're (sort of) user input, you shouldn't trust them! Take the usual precautions to avoid things like SQL injection etc.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.