secure session management for web applications - cdn

40
!"#$%" !"’’()* +,*,-"."*/ 0)% 1"2 3445(#,/()*’ 67%(’ 8,5."% (!96 8,%/*"%’: ;*#< 7//4’=>>???<(’"#4,%/*"%’<#).>

Upload: others

Post on 09-Feb-2022

6 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Secure Session Management for Web Applications - Cdn

!"#$%"&!"''()*&+,*,-"."*/0)%&1"2&3445(#,/()*'

67%('&8,5."%(!96&8,%/*"%':&;*#<

7//4'=>>???<('"#4,%/*"%'<#).>

Page 2: Secure Session Management for Web Applications - Cdn

17)&3.&;@

(!96&8,%/*"%'=&')0/?,%"&'"#$%(/A&"*-(*""%(*-&#)*'$5/,*/'<

1"&,%"&0)%."%&B"C"5)4"%'&,*B&)4'&"*-(*""%'D&'"#$%(/A&%"'",%#7"%'<&;&7,C"&2""*&,&?"2&,44&B"C"5)4"%&,*B&!/,00&E"#7*)5)-('/&,/&/7"&95"#/%)*(#&F%)*/("%&F)$*B,/()*<1"&7"54&')0/?,%"&C"*B)%'&G7$-"&,*B&'.,55H&.,I"&/7"(%&4%)B$#/'&',0"%<&1"&0(*B&2$-':&"J45,(*&/7"&(.4,#/:&(B"*/(0A&/7"&')5$/()*'<

1"&?)%I&)*=&*,/(C"&,44':&?"2&,44':&)4"%,/(*-&'A'/".'<&!)0/?,%"&A)$&7,C"&7",%B&)0&,*B&,%"&$'(*-&*)?<

!)."&2$-'&'7)?&$4&,-,(*&,*B&,-,(*<&K)4"0$55A&/7('&/,5I&?(55&7"54&A)$&,C)(B&/7".L

Page 3: Secure Session Management for Web Applications - Cdn

17)&3%"&M)$@

N)2'&A)$&B)=!)0/?,%"&B"C"5)4."*/!)0/?,%"&/"'/(*-O;>OP&B"C"5)4."*/+,*,-"."*/:&2$'(*"''&B"C"5)4."*/3445(#,/()*&'"%C"%&B"45)A."*/

E"'/(*-&/))5'&A)$&$'"=1(%"'7,%I1"2!#,%,28"%5>8A/7)*>Q$2AF(%"0)J&"J/"*'()*'=&3BB&R*R&9B(/&6))I("':&1"2&S"C"5)4"%:&F(%"2$-

Page 4: Secure Session Management for Web Applications - Cdn

17)&3%"&M)$@

T,*-$,-"'&,*B&45,/0)%.'&A)$&$'"=N,C,Q$2A<U9EO*(J>T(*$J1(*B)?'8A/7)*F$*#/()*,5&7(4'/"%&5,*-$,-"&G!#,5,:&K,'I"55:&9%5,*-:&+(%,*B,H6>6VV&GS@LH&!WT6X!/)%"3.,Y)*&!Z[/7"%&'/)%,-"

Page 5: Secure Session Management for Web Applications - Cdn

E"%.(*)5)-A

!"##$%&'(%)"&3*A/7(*-&A)$&$'"&/)&5(*I&'"4,%,/"&%"\$"'/'&(*/)&,&'(*-5"&'"''()*=&KEE8&#))I(":&F5,'7&T![:&.,-(#&]9E&)%&8[!E&4,%,."/"%':&.,-(#&OQT&#).4)*"*/'<KEE8&#))I("'&,%"&4"%7,4'&/7"&.)'/&#)..)*&."#7,*('.<

*+,*&,*B&-.($/"'&"(0%1)'-((-.)#+)*I"A&G)%&+,*:&)%&8"%')*H&;*&E7"&+(BB5"=&/7"&,//,#I"%&#)*/%)5'&/7"&*"/?)%I&(*0%,'/%$#/$%"&')."?7"%"&2"/?""*&5"-(/(.,/"&#5("*/&,*B&5"-(/(.,/"&'"%C"%<^,%()$'&?,A'&/)&,#7("C"&/7('&,//,#I<+2'"/"13(4$&5'5%"#'0"66:&ET!&C_>!!T&CZ&4%"C"*/'&(/<

Page 6: Secure Session Management for Web Applications - Cdn

E"%.(*)5)-A

7-##$/"'&"(0%1)'-((-.)17"*&/7"&,//,#I"%&B)"'&*)/&*""B&/)&)?*&/7"&*"/?)%I&(*0%,'/%$#/$%"<E7"&4,''(C"&,//,#I"%&('&,''$."B&/)&7,C"&')."/7(*-&5(I"&1(%"'7,%I&G7//4=>>???<?(%"'7,%I<)%->H<E7"&4,''(C"&,//,#I"%&.,A&,5')&#)*/%)5&/7"(%&)?*&?"2&#)*/"*/:&5(I"&7//4=>>???<#A2"%C(55,(*'<#).><3*&,#/(C"&,//,#I"%&('&$'$,55A&,''$."B&/)&,5')&7,C"&4,''(C"&,//,#I&#,4,2(5(/A<

Page 7: Secure Session Management for Web Applications - Cdn

E"%.(*)5)-A=&8")45"

86$."&,*B&9%:T"-(/(.,/":&7)*"'/&$'"%'&)0&"J,.45"<#).<+$/$,55A&/%$'/(*-<<<&.)'/5A<

*-66%13+,5(#()$'&$'"%&)0&"J,.45"<#).<Q$*'&#A2"%C(55,(*'<#).<+,A&7,C"&')0/?,%"&B"C"5)4."*/&'I(55'<

;-/"S"C(5('7&$'"%&)0&"J,.45"<#).<+,A&#)55$B"&?(/7&+,55)%A<+,A&7,C"&')0/?,%"&B"C"5)4."*/&'I(55'<

</"6,*&4,''(C"5A&",C"'B%)4&)*&35(#"&,*B&`)2<

Page 8: Secure Session Management for Web Applications - Cdn

E7"&;*/"%*"/&!"#$%(/A&+)B"5

aK)4"0$55A:&')."&4,#I"/'&?(55&-"/&/)&')."&7)'/:&')."&)0&/7"&/(."<&E7"A&.(-7/&*)/&"C"*&2"&/))&2,B5A&B,.,-"B&?7"*&/7"A&,%%(C"La

Page 9: Secure Session Management for Web Applications - Cdn
Page 10: Secure Session Management for Web Applications - Cdn

+;E+&;'&3&^(,25"&`$'(*"''&+)B"5

]"":&B)&A)$&/7(*I&;&'7)$5B&7,C"&#5(#I"B&)*&/7"&S)?*5),B&]))-5"&E))52,%&2$//)*@

E%,B".,%I&,*B>)%&#)4A%(-7/&C()5,/()*&-))B*"''&(*&,BB(/()*&/)&4)/"*/(,5&.,5?,%"<

!""&,5')&%"#"*/&"J#(/"."*/=7//4=>>25)-<?,'7(*-/)*4)'/<#).>'"#$%(/A0(J>bccd>ce>&&&&?7"*f.)*"/(Y(*-f('4f/%,00(#f-)<7/.57//4=>>???<B)J4,%,<#).>S+gfU"$/f/))%<44/

+)*I"AX(*X/7"X.(BB5"&('&')&%"5(,25":&(/&#,*&2"&B"4"*B"B&)*&0)%&%"C"*$"<&3//,#I"%'&%"5A&)*&(/&h$'/&,'&.$#7&,'&a.('-$(B"Ba&.,%I"/(*-&B"4,%/."*/'<&S"0"*B&A)$%&$'"%'L

Page 11: Secure Session Management for Web Applications - Cdn

+)'/&U"?&3445(#,/()*'&3%"&1"2X2,'"B

+)'/&?"2&,445(#,/()*':&"'4"#(,55A&*"?&)*"':&,%"&$*',0"&0)%&$'"&)*&/7"&(*/"%*"/<

Q",55A<

E7"&?"2&('&)*"&)0&/7"&.)'/&#).45"J&,445(#,/()*&45,/0)%.'&"C"%:&,*B&"C"%A&,445(#,/()*&('&#)**"#/"B&/)&"C"%A&)/7"%&,445(#,/()*&(*&/7"&?)%5B<

S"'4(/"&/7(':&(/&('&4)''(25"&/)&2$(5B&'"#$%"&,445(#,/()*'&XX&2$/&*)/&*"#"'',%(5A&",'A<&E)B,A&?"R55&/,5I&,2)$/&'"''()*&.,*,-"."*/:&,&I"A&/)&2$(5B(*-&'"#$%"&,445(#,/()*'<

8%)25".'&-&=&')5$/()*'L

Page 12: Secure Session Management for Web Applications - Cdn

!"#$%(/A&3''"%/()*'&1"&1,*/&/)&+,I"

35(#"&#,**)/&%",B&)%&?%(/"&`)2R'&B,/,&$*5"''&7"&?,*/'&7"%&/)<+,55)%A&#,**)/&2$A&'/$00&?(/7&35(#"R'&.)*"A<S,C"&#,**)/&#,$'"&/7"&'"%C(#"&/)&2"&$*,C,(5,25"&0)%&35(#"&,*B&`)2<17"*&35(#"&%",B'&8)4$5,%`5)-<#).:&#)B"&)*&/7"&4,-"&#,**)/&%",B&/7"&#)*/"*/'&)0&/7"&)/7"%&/,2&'7"&7,'&)4"*=&3h,J+,(5<#).<U)%&'7)$5B&8)4$5,%`5)-&2"&,25"&/)&.,I"&%"\$"'/'&/)&3h,J+,(5&,-,(*'/&35(#"R'&?(55<S,C"&#,*&*)/&/,I"&#)*/%)5&)0&/7"&'"%C"%<

>#"1#'04%'=$#.%/"1'(4"3'-1"'&%('#-2"'%&'3%?1'#$("'-1"'?&4-@@3'?#"1#A

;0&,''"%/()*'&5(I"&/7"'"&B)&*)/&7)5B&0)%&A)$%&,445(#,/()*:&A)$%&$'"%'&.(-7/&2"&,//,#I"B<&E7"A&.(-7/&/,I"&/7"(%&.)*"A:&#5(#I':&.(*B'7,%":&)%&0%("*B'&"5'"?7"%"<

Page 13: Secure Session Management for Web Applications - Cdn

!"#$%(/A&6)'/'&+)*"A

S"C"5)4(*-&'"#$%"&,445(#,/()*'&*)?&('&#7",4"%&/7,*&B",5(*-&?(/7&/7"&0,55)$/&5,/"%<

N$'/&,'I&(!96R'&#5("*/'L

[*"&)0&)$%&#5("*/'&('&!.,%/&Q;3&!/,%/$4<&;&/"'/"B&/7"(%&,44:&,*B&/7"A&*",/5A&,C)(B&.,*A&#)..)*&4(/0,55'<

3*)/7"%&)0&)$%&#5("*/'&('&*,."B&T,%-"&!$##"''&!/)%A&E7,/&8,A'&E))&+$#7&F)%&Q"."B(,/()*&U)?<&G`"//"%&'"#$%(/A&?)$5B&"\$,5&2"//"%&4%)0(/&.,%-(*'LH

Page 14: Secure Session Management for Web Applications - Cdn

!"''()*&+,*,-"."*/&O*B"%5("'&+,*A&!"#$%(/A&3''"%/()*'

1"&*""B&/)&I*)?&/7,/&(4$#'1"B?"#(&%",55A&#,."&0%).&/7"&@"1#%&'6$&)"='0$(4'(4"'86$."'-..%?&(&2"0)%"&?"&#,*&.,I"&'"#$%(/A&B"#('()*'&%"-,%B(*-&35(#"R'&B,/,<K,C"&?"&2""*&/,5I(*-&/)&/7"&',."&4"%')*:&5(*I"B&?(/7&/7"&',."&,##)$*/:&0)%&/7"&?7)5"&'"''()*@&6)$5B&,*A)*"&7,C"&7(h,#I"B&#)*/%)5&)0&/7"&%",5&35(#"R'&'"''()*@17,/&,2)$/&'(*-5"&'(-*X)*&')5$/()*'&G.$5/(45"&,445(#,/()*'&,##"''"B&0%).&,&'(*-5"&'"''()*H@&S)&?"&B)?*-%,B"&/7"&'"#$%(/A&)0&/7"&.)'/&'"*'(/(C"&,44&/)&,##)..)B,/"&,*&(*'"#$%"&,44&(*&,*&!![&'(/$,/()*@

Page 15: Secure Session Management for Web Applications - Cdn

!"''()*&+,*,-"."*/&;'&[0/"*&1",I&(*&Q",5X?)%5B&3445(#,/()*'

;/R'&'$%4%('(*-5A&7,%B&/)&-"/&%(-7/&XX&/7"%"&,%"&.,*A&5(//5"XI*)?*&-)/#7,'<_< T,#I&)0&KEE8!:&(*#).45"/"&$'"&)0&KEE8!b< `%),B5AX'#)4"B&#))I("'&(*&,&B).,(*&?(/7&.,*A&,445(#,/()*'Z< ]$"'',25"&'"''()*&;S'e< 6%)''X'(/"&'#%(4/(*-i< 6%)''X'(/"&%"\$"'/&0)%-"%Aj< !"''()*&0(J,/()*k< !"''()*&'/,/"&'/)%"B&B(%"#/5A&(*&/7"&#))I(":&$*',0"5A_< ;*/"-%(/A&('&*)/&/7"&',."&,'&#)*0(B"*/(,5(/ALb< F,I"&#%A4/)&('&*)/&#%A4/)LZ< !/,/(#&'/%(*-'&(*&/7"&')$%#"&#)B"&,%"&*)/&'"#%"/&I"A'L

Page 16: Secure Session Management for Web Applications - Cdn

E7"&6))I("&;'&9\$(C,5"*/&/)&,&8,''?)%B&GE".4)%,%(5AH9C"%A)*"&%"#)-*(Y"'&/7,/&?"&*""B&/)&I""4&$'"%'R&4,''?)%B'&'"#%"/<&1"&)0/"*&$'"&KEE8!&0)%&/7"&5)-(*&'"\$"*#"&0)%&/7,/&%",')*<

30/"%&5)-(*:&7)?&B)&?"&I*)?&?7)&/7"&$'"%&('@&E7"(%&#))I("<

E7"%"0)%":&/7"&#))I("&('&/7"&I"A&/)&/7"&$'"%R'&'"''()*&XX&,*B&,''"/'L&g(*B&)0&5(I"&,&4,''?)%B:&%(-7/@

!)&?"&.$'/&4%)/"#/&/7"&#))I("&h$'/&,'&?"&4%)/"#/&/7"&4,''?)%B<

O*5"''&A)$%&,44&$'"'&KEE8!&0)%&5)-(*&,*B&,55&4)'/X5)-(*&/%,00(#:&3%?1'?#"1#'-1"'&%('#-2"<&8,''(C"&,//,#I"%'&#,*&'/",5&$'"%'R&&B,/,&XX&,*B&#))I("':&,55)?(*-&/7".&/)&(.4"%')*,/"&/7"&%",5&$'"%<

Page 17: Secure Session Management for Web Applications - Cdn

Q",55A@L

M"':&;&I*)?&!$4"%;.4)%/,*/<#).&,*B&+"-,+,h)%3?"')."<#).&B)*R/&$'"&KEE8!&/7%)$-7)$/<

U):&/7"(%&$'"%'&,%"&*)/&',0":&"(/7"%<

,4$#'$#'-'C-1)"('%@@%1(?&$(3'2%1'3%?D'>&="1.?('(4"C'%&'%@"1-($%&#'.%#(#'-&='@1%/$="'-':"(("1'?#"1'"E@"1$"&."'-('(4"'#-C"'($C"A

M)$R55&*""B&/)&"5(.(*,/"&#%)''X'(/"&'#%(4/(*-&,*B&#%)''X'(/"&%"\$"'/&0)%-"%A&/)):&)0&#)$%'"<&E7"*&/7"%"R'&47('7(*-<<<

F,,7!'$#'-':-#"6$&"G':-1"HC$&$C?C'6"/"6'%2'#".?1$(3A

Page 18: Secure Session Management for Web Applications - Cdn

E7"&;*/"%*"/&!"#$%(/A&+)B"5&G3-,(*H

F,,7!'IF,,7'0$(4',J!K'@1%/$="#'2"-(?1"#'0"'&""=D!"%C"%&,$/7"*/(#,/()*&GC(,&/%$'/"B&/7(%B&4,%/AH;*/"-%(/A&4%)/"#/()*&GB,.,-"B>.,*-5"B&4,#I"/'&,%"&B"/"#/"B&,*B&B('#,%B"BD&#).4$/,/()*,55A&(*0",'(25"&0)%&,*&,#/(C"&,//,#I"%&/)&B,.,-"&/7"&4,#I"/'&$*B"/"#/,25AH6)*0(B"*/(,5(/A&4%)/"#/()*&G#).4$/,/()*,55A&(*0",'(25"&0)%&,&4,''(C"&,//,#I"%&/)&B"#%A4/&/7"&4,#I"/'H[4/()*,5&#5("*/&,$/7"*/(#,/()*&G,-,(*&C(,&/%$'/"B&/7(%B&4,%/AH

Page 19: Secure Session Management for Web Applications - Cdn

O'"&/7"&!"#$%" &3//%(2$/"&)*&6))I("'

;0&A)$&$'"&KEE8!&,55&/7"&/(.":&/7,/R'&-))B&XX&2$/&*)/&A"/&$*2",/,25"<&;0&A)$&$'"&KEE8&#))I("':&$'"&/7"&!"#$%" &,//%(2$/"&G2))5",*H<&E7('&/"55'&/7"&2%)?'"%&a[*5A&'"*B&/7('&#))I("&)C"%&/7"&*"/?)%I&$'(*-&KEE8!:&*"C"%&KEE8<a

Page 20: Secure Session Management for Web Applications - Cdn

O'"&/7"&!"#$%" &3//%(2$/"

17A@&S,C"&".2"B'&/7"'"&/,-'&(*&,&4,-"&7"&#)*/%)5'&G4"%7,4'&2A&+;E+H:&,*B&?7(#7&/7"&C(#/(.&.,A&C("?&G"<-<&7//4=>>0)%$.<"J,.45"<#).>H=

!"#$%&'()*+,,-.//0001234#-521(6#/748219-$*%/:!"#$%&'()*+,,-.//0001234#-521(6#.;;</748219-$*%/:

E7"&2%)?'"%&?(55&'"*B&/7"&#))I("&?7"*&.,I(*-&/7)'"&%"\$"'/':&$*5"''&!"#$%" &('&'"/L

Page 21: Secure Session Management for Web Applications - Cdn

O'"&/7"&!"#$%" &3//%(2$/"

`,B=

=2,>?668"2.%"@)AB<=2,>?668"2.%"@)AB<C%D6#4"E)7"E4E(21234#-521(6#

]))B=

=2,>?668"2.%"@)AF<BG;HBIAFBAJBA<;C%=2(K'2=2,>?668"2.%"@)AF<BG;HBIAFBAJBA<;C%=2(K'2C%%%%%D6#4"E)7"E4E(21234#-521(6#

Page 22: Secure Session Management for Web Applications - Cdn

!#)4"&/7"&6))I("&U,%%)?5A

1"&,5')&*""B&/)&'"/&/7"&&'()*+ &,//%(2$/"&,'&*,%%)?5A&,'&4)''(25"<&T",C(*-&(/&25,*I&('&2"'/L

;.,-(*"&/?)&,445(#,/()*'=&7//4'=>>0(*,*#"<"J,.45"<#).&,*B&7//4=>>?(I(<"J,.45"<#).<

;0&/7"&#))I("&('&'"/&?(/7&&'()*+ &a<"J,.45"<#).a:&/7"&?(I(&?(55&-"/&/7"&#))I("'&0)%&/7"&0(*,*#(,5&,44<&17,/&(0&?(I(&#)*/,(*'&N,C,!#%(4/&'$445("B&2A&S,C"@&17,/&(0&9C"&)2'"%C"'&/7"&$*"*#%A4/"B&/%,00(#&/)&?(I(@&[)4'<

GU)/"&/7,/&(0&!"#$%" &('&'"/&)*&/7"&0(*,*#"&#))I(":&/7"&#))I("&?(55&*)/&-)&/)&?(I(&)C"%&KEE8:&2$/&'/(55&?(55&)C"%&KEE8!<H

Page 23: Secure Session Management for Web Applications - Cdn

!#)4"&/7"&6))I("&U,%%)?5A

`,B=

=2,>?668"2.%"@)AB<C%D6#4"E)1234#-521(6#=2,>?668"2.%"@)AB<C%=2(K'2C%D6#4"E)1234#-521(6#

]))B=

=2,>?668"2.%"@)AF<BG;HBIAFBAJBA<;C%=2(K'2C=2,>?668"2.%"@)AF<BG;HBIAFBAJBA<;C%=2(K'2C%%%%%D6#4"E)7"E4E(21234#-521(6#

Page 24: Secure Session Management for Web Applications - Cdn
Page 25: Secure Session Management for Web Applications - Cdn
Page 26: Secure Session Management for Web Applications - Cdn
Page 27: Secure Session Management for Web Applications - Cdn
Page 28: Secure Session Management for Web Applications - Cdn

!"''()*&E)I"*'&+$'/&`"&O*4%"B(#/,25"

;0&/7"&,//,#I"%&#,*&,$"-- &/7"&C,5$"&)0&,&C,5(B&'"''()*&/)I"*:&/7,/R'&h$'/&,'&2,B&,'&(0&/7"&,//,#I"%&.*-#'/"%". &(/<&8"%7,4'&?)%'"&XX&/7"&,//,#I"%&B)"'*R/&7,C"&/)&2"&*",%&/7"&C(#/(.L

Page 29: Secure Session Management for Web Applications - Cdn

!"''()*&E)I"*'&+$'/&`"&O*4%"B(#/,25"

`,B&/)I"*'=3$/)X(*#%"."*/(*-&S`&/,25"&;S'8'"$B)X%,*B).&*$.2"%'&/7,/&#)."&0%).&B"/"%.(*('/(#&0$*#/()*'!.,55&*$.2"%'E7"&#,%B(*,5(/A&)0&/7"&'"/&)0&/)I"*'&.$'/&2"&7$-"&%"5,/(C"&/)&/7"&,C"%,-"&*$.2"%&)0&,#/(C"&'"''()*'

E7"&#$%%"*/&/(."&(*&G.(55(H'"#)*B'2,'"jeG$'"%*,."H

Page 30: Secure Session Management for Web Applications - Cdn

!"''()*&E)I"*'&+$'/&`"&O*4%"B(#/,25"

]))B&/)I"*'=_bdX2(/'&)0&"*/%)4A&0%).&G"J,.45"'H=

>B"C>%,*B).&GO*(JH:0)/)1!"#$%*231!"#$%"4)+.'( &GN,C,H:'-1$%)+.'( &G8A/7)*H:!3-2"(1!"#$%*2315%362',%)67314895%362'!"%/*#":%'/*."% &G6l><U9EH

Page 31: Secure Session Management for Web Applications - Cdn

!"''()*&E)I"*'&+$'/&`"&O*4%"B(#/,25"

E7('&-(C"'&$'&,&7$-"&'"/&Gbm_bdH&)0&4)''(25"&'"''()*&/)I"*':&"C"*5A&B('/%(2$/"B:&-"*"%,/"B&(*&,*&$*4%"B(#/,25"&'"\$"*#"<

E7,/R'&(/:&A)$R%"&B)*"&XX&*)&)/7"%&.,*-5(*-&*"#"'',%A<

3&-))B&?"2&,44&0%,."?)%I&7,*B5"'&/7('&0)%&A)$&G%"#"*/&<U9E:&%"#"*/&N,C,&XX&2$/&8K8&B(',25"'&/7"&-))B&2"7,C()%&2A&B"0,$5/LH<

Page 32: Secure Session Management for Web Applications - Cdn
Page 33: Secure Session Management for Web Applications - Cdn

6%)''X'(/"&Q"\$"'/&F)%-"%A

U)/7(*-&'/)4'&#A2"%C(55,(*'<#).&0%).&0)%.$5,/(*-&%"\$"'/'&/)&"J,.45"<#).<

9C"*&%"\$"'/'&/7,/&#,$'"&,&B"'/%$#/(C"&)%&'"*'(/(C"&,#/()*&/)&7,44"*L

;0&35(#"&('&,$/7"*/(#,/"B&?(/7&"J,.45"<#).&G7,'&,&#))I("H:&,*B&C('(/'&#A2"%C(55,(*'<#).&(*&,*)/7"%&/,2:&#A2"%C(55,(*'<#).&#,*&#,$'"&7"%&2%)?'"%&/)&.,I"&,&B,*-"%)$'&%"\$"'/&/)&"J,.45"<#).<

9J,.45"<#).&?(55&7)*)%&/7"&%"\$"'/&XX&'7"&('&,$/7"*/(#,/"B:&,0/"%&,55L

Page 34: Secure Session Management for Web Applications - Cdn

6%)''X'(/"&Q"\$"'/&F)%-"%A

9.2"BB"B&(*&#A2"%C(55,(*'<#).>(*B"J<7/.5=

!"#$%&'()*+,,-&.//234#-521(6#/@252,2L'67"5219&-M(6E7"'#),'K2*%/:

E7('&?)%I'&2"#,$'"&/7"&'/%$#/$%"&)0&/7"&B"5"/"&4%)0(5"&,#/()*&('&4%"B(#/,25"<

"J,.45"<#).&?(55&'""&/7,/&35(#"&('&,$/7"*/(#,/"B<

"J,.45"<#).&7,'&*)&?,A&/)&I*)?&/7,/&35(#"&B(B*R/&(*/"*B&/)&B)&/7,/L&;/&('&(*&"C"%A&?,A&,&C,5(B&%"\$"'/<

Page 35: Secure Session Management for Web Applications - Cdn

6%)''X'(/"&Q"\$"'/&F)%-"%A

S,C"&B)"'*R/&*""B&/)&'/",5&35(#"R'&#))I("&(*&)%B"%&/)&,2$'"&/7"&,$/7)%(/A&(/&#)*0"%'&/)&7"%L

K)?&#,*&?"&'/)4&/7('&0%).&7,44"*(*-@

6)*'(B"%&/7"&#)..)*&a#7,*-"&4,''?)%Ba&,#/()*=&M)$&%"\$(%"&/7"&$'"%&/)&4%)C(B"&/7"(%&#$%%"*/&,'&?"55&,'&/7"(%&*"?&4,''?)%B<

17A@

Page 36: Secure Session Management for Web Applications - Cdn

6%)''X'(/"&Q"\$"'/&F)%-"%A

`$/&?"&#,*R/&.,I"&35(#"&%"X/A4"&7"%&4,''?)%B&0)%&"C"%A&,#/()*&/7"&,445(#,/()*&B)"'L

1"&*""B&/)&%"\$(%"&,&4,%,."/"%&/)&/7"&,#/()*&/7,/&S,C"&#,**)/&4%"B(#/&)%&B('#)C"%:&?7(#7&('&$*(\$"&/)&35(#"R'&'"''()*&,*B&/)&/7"&,#/()*<

3*'?"%=&,*&"*/%)4(#:&$*(\$"&/)I"*&'/)%"B&(*&,&7(BB"*&0("5B<

!76'#%4(,"6E)*+,,-&.//234#-521(6#/@252,2L'67"5219&-*:!"E-K,%,N-2)+"@@2E%E4#2),682E%O45K2)HBFBAGBHHBGJFAHBAFBA:!"E-K,%,N-2)&KP#",%O45K2)*D252,2%L'67"52Q*:

Page 37: Secure Session Management for Web Applications - Cdn

6%)''X'(/"&Q"\$"'/&F)%-"%A

E7"&'"%C"%&%".".2"%'&/7"&/)I"*&C,5$"<

17"*&/7"&'"%C"%&%"#"(C"'&,&%"\$"'/&/)&B"5"/"&35(#"R'&4%)0(5":&(/&#7"#I'&/7,/&/7"&"J4"#/"B&$*(\$":&$*4%"B(#/,25"&/)I"*&('&(*&/7"&%"\$"'/<

;0&(/&(':&/7"&%"\$"'/&('&C,5(B=&0)%.$5,/"B&2A&/7"&,44&(/'"50<

;0&(/&('&*)/:&/7"&%"\$"'/&('&0)%-"B=&0)%.$5,/"B&2A&').")*"&?7)&B(B*R/&I*)?&/7"&/)I"*&C,5$"L

S)&*)/&7)*)%&0)%-"B&%"\$"'/'<

Page 38: Secure Session Management for Web Applications - Cdn

6)*#5$'()*

!"#$%(/A&('&#7",4"%&*)?&/7,*&(/&('&5,/"%<

M)$%&#).4"/(/)%&('&4,A(*-&/))&.$#7&0)%&%"."B(,/()*<&17,/&,2)$/&A)$@

!"''()*&.,*,-"."*/&$*B"%5("'&#%$#(,5&'"#$%(/A&,''"%/()*'&,*B&2$'(*"''&%"\$(%"."*/'<

Page 39: Secure Session Management for Web Applications - Cdn

6)*#5$'()*

+)%"&*"%BA&B"/,(5'&)*&'"''()*&.,*,-"."*/&?(55&'))*&2"&,C,(5,25"&,/

7//4'=>>???<('"#4,%/*"%'<#).>4$25(#,/()*'<7/.5

Page 40: Secure Session Management for Web Applications - Cdn

6)*#5$'()*

E7,*I&A)$&0)%&#).(*-L

(!96&('&7(%(*-=

#,%""%'n('"#4,%/*"%'<#).

;&5)C"&\$"'/()*'=

#7%('n('"#4,%/*"%'<#).