Web Security: Common Vulnerabilities And Their Mitigation - Session hijacking counter measures

What is a key measure to prevent session fixation attacks?

• Share session IDs publicly

• Use the same session ID for all users

• Generate a new session ID after user login

• Allow users to specify their session ID

What should be done immediately after a user logs in?

• Keep the same session ID

• Generate a new session ID

• Log the user out

• Share the session ID with others

What does a strict session setup ensure?

• Session IDs are tied to user-specific information

• Session IDs are never changed

• Session IDs are user-generated

• Session IDs are shared among users

Why is it important to have a proper logout procedure?

• To prevent users from logging out

• To keep sessions active indefinitely

• To allow users to log in multiple times

• To ensure all sessions are destroyed on logout

What is the purpose of using session timeouts?

• To allow sessions to last forever

• To prevent trap sessions

• To keep sessions active with periodic requests

• To ensure sessions are never terminated