Show HN: WebSession, a Secure Replacement for Cookies

Post by apitman » Tue, Oct 24, 2023, 4:22 AM UTC

oefrha wrote: post #9

The only thing in this protocol that prevents the reuse of Authorization header is keeping track of nonce: > Validating that the nonce has not been used already for this session. Important: at this point, the nonce should be added to the ‘seen’ set, because nonces should be invalidated whether the signature validation passes or fails. Failure to do so can allow attackers to brute-force a valid signature for a single…

Post by kortex » Tue, Oct 24, 2023, 4:43 AM UTC

tfigueroa wrote: post #12

oefrha wrote: post #9

The only thing in this protocol that prevents the reuse of Authorization header is keeping track of nonce: > Validating that the nonce has not been used already for this session. Important: at this point, the nonce should be added to the ‘seen’ set, because nonces should be invalidated whether the signature validation passes or fails. Failure to do so can allow attackers to brute-force a valid signature for a single…

I thought I was misreading this. It seems onerous to keep track of every nonce, even scoped to a given session. Maybe I’m missing something.

Post by robertlagrant » Tue, Oct 24, 2023, 4:59 AM UTC

thwarted wrote: post #20

It’s also very common that a website wants credentials to be cleared when the user is inactive for a certain amount of time. This is important for sensitive applications such as banking and healthcare. Currently there’s no way to enforce that a cookie is cleared on device lock or user inactivity, especially because security requires that such cookies not be visible to JavaScript. A native session management solution…

Post by Beldin » Tue, Oct 24, 2023, 5:25 AM UTC

Post by lolinder » Tue, Oct 24, 2023, 5:37 AM UTC

porridgeraisin wrote: post #13

The only real advantage I see here is having a dedicated storage for session identifiers as opposed to clubbing it with other non-essential cookies. Everything else in the proposal isn't really required. Considering this, simply choosing a standard name for session cookies suffices. Browsers can give an option to the user to rejects all cookies that don't have the name "WebSession". This is already achievable using e…