What is session ID? - Definition from WhatIs.com

http://www.geeksforgeeks.org/session-hijacking/

What is session ID? - Definition from WhatIs.com
A session ID is a unique number that a Web site's server assigns a specific user for the duration of that user's visit (session). The session ID can be stored as a cookie, form field, or URL (Uniform Resource Locator).

Session IDs, in their conventional form, do not offer secure Web browsing. Skilled hackers can acquire session IDs (a process called session prediction), and then masquerade as authorized users in a form of attack known as session hijacking.

The session ID can also provide automatic authentication for future visits to that site or associated sites. If a cracker obtains session ID data, he can conduct an attack, such as session hijacking or session replay.https://en.wikipedia.org/wiki/Session_ID
As session IDs are often used to identify a user that has logged into a website, they can be used by an attacker to hijack the session and obtain potential privileges. A session ID is often a long, randomly generated string to decrease the probability of obtaining a valid one by means of a brute-force search. Many servers perform additional verification of the client, in case the attacker has obtained the session ID.

A session token is a unique identifier, usually in the form of a hash generated by a hash function that is generated and sent from a server to a clientto identify the current interaction session. The client usually stores and sends the token as an HTTP cookie and/or sends it as a parameter in GETor POST queries. The reason to use session tokens is that the client only has to handle the identifier (a small piece of data which is otherwise meaningless and thus presents minimal security risk) - all session data is stored on the server (usually in a database, to which the client does not have direct access) linked to that identifier. 

JSESSIONID (Java EE), PHPSESSID (PHP), and ASPSESSIONID (Microsoft ASP)
http://www.shuatiblog.com/blog/2014/08/28/Http-cookie/
Types of HTTP Cookie

Session cookie
Persistent cookie

Max-age 1 year. The value set in that cookie would be sent back to the server every time the user visited the server. Also called tracking cookies

Secure cookie

The secure attribute is enabled, and is only used via HTTPS.

Third-party cookie

First-party cookies are cookies that belong to the same domain that is shown in the browser’s address bar. Third-party cookies are cookies that belong to domains different from the one shown in the address bar.

It opens up the potential for tracking the user’s browsing history.

Nowadays ther’e a new kind of HttpOnly cookie (used only when transmitting HTTP (or HTTPS) requests, thus restricting access from other, non-HTTP APIs such as JavaScript).
https://en.wikipedia.org/wiki/Session_hijacking

• Use of a long random number or string as the session key. This reduces the risk that an attacker could simply guess a valid session key through trial and error or brute force attacks.

• Regenerating the session id after a successful login. This prevents session fixation because the attacker does not know the session id of the user after s/he has logged in.
• Some services make secondary checks against the identity of the user. For example, a web server could check with each request made that the IP address of the user matched the one last used during that session. This does not prevent attacks by somebody who shares the same IP address, however, and could be frustrating for users whose IP address is liable to change during a browsing session.

http://resources.infosecinstitute.com/session-hijacking-cheat-sheet/
Session sidejacking

1. SSL only for login page: Of course if there is no SSL then the credentials too would be gone (forget about cookies!), but there are some developers who use SSL for the login page alone, assuming that the credentials are transported safely. But once the user is authenticated, it is the cookies (that go with each request) that identify him. All the requests that are done after logging in contain cookies, and if they are not protected with SSL, the session can be easily hijacked. Thus the password may not be stolen, but the session can be hijacked.
2. Single URL is enough to hijack a user.

Session fixation

Session fixation is an attack where the attacker fixes the session in advance and just waits for the user to login in order to hijack it. This is very much applicable to the SIDs in the URL scenario. If the application associates a user with an incoming SID without checking if it is generated by the server, then this attack is possible.

Generating cookies before authentication

Cookies are supposed to be generated (or at least changed) after successful authentication. If the same cookie which is generated before authentication is used after authentication, then session hijacking is possible, as explained here with a simple example. 

Predictable session IDs
How to get the IP address when a session is created?

you can access the RequestContextHolder and get the value

String ipAddr = ((ServletRequestAttributes)RequestContextHolder.currentRequestAttributes())
           .getRequest().getRemoteAddr();

Binding of IP address with Session id
http://stackoverflow.com/questions/30115960/does-a-java-session-httpsession-validate-ip-addresses

When a session is created for a user,

• a session id is created on server side.
• This session id is sent to the browser who sent the request
• this id is stored in a cookie called JSESSIONID
• Browser sends this cookies for subsequent request
• Server knows the session id on server side and validates with the one in cookies
• ip address is not checked for subsequent request. Session is identified using jsessionid

https://blog.8thlight.com/adam-gooch/2013/03/01/help-prevent-session-hijacking.html
Unpredictability
SSL Is Important

Another, less draconian, method is to set the cookie as “secure”. This ensures the cookie itself will only be transmitted over an SSL connection.

Sessions Should End
a sign out button should be easy to find on every page of your application. Make it easy for users to destroy their session when they want to.

HTTP Only

There are several cross site scripting (XSS) attacks aimed at stealing session cookies. Setting the cookie’s HttpOnly attribute prevents the cookie from being transmitted via scripts, greatly reducing the risk of XSS.
cookies.signed[:secure_session] = {httponly: true, value: "#{user.salt}#{user.id}"}

Restrict The Domain(and path)
If the attribute is not explicitly set, the default value is set to only allow the cookie to be sent to the origin server. If the application requires a broader set of permissions, it can be accomplished by specifying the domain attribute upon cookie creation.

Read full article from What is session ID? - Definition from WhatIs.com

How are cookies passed in the HTTP protocol?

https://www.owasp.org/index.php/SecureFlag
https://resources.infosecinstitute.com/securing-cookies-httponly-secure-flags/#gref
Securing cookies is an important subject. Think about an authentication cookie. When the attacker is able to grab this cookie, he can impersonate the user.

the cookie with a secure flag will only be sent over an HTTPS connection.

https://stackoverflow.com/questions/13729749/how-does-cookie-secure-flag-work

The Secure attribute limits the scope of the cookie to "secure" channels (where "secure" is defined by the user agent). When a cookie has the Secure attribute, the user agent will include the cookie in an HTTP request only if the request is transmitted over a secure channel (typically HTTP over Transport Layer Security (TLS) [RFC2818]).

Although seemingly useful for protecting cookies from active network attackers, the Secure attribute protects only the cookie's confidentiality. An active network attacker can overwrite Secure cookies from an insecure channel, disrupting their integrity (see Section 8.6 for more details).

http://stackoverflow.com/questions/3467114/how-are-cookies-passed-in-the-http-protocol

The server sends a

Set-Cookie: name=value

in its response header to set the field. If there is a cookie set then the browser sends a

Cookie: name=value

in its request header

http://www.nczonline.net/blog/2009/05/05/http-cookies-explained/
Quite simply, a cookie is a small text file that is stored by a browser on the user’s machine. A web page or server instructs a browser to store this information and then send it back with each subsequent request based on a set of rules. Web servers can then use this information to identify individual users.

Set-Cookie: name=Nicholas; expires=Sat, 02 May 2009 23:38:25 GMT

The next option is domain, which indicates the domain(s) for which the cookie should be sent. By default, domain is set to the host name of the page setting the cookie, so the cookie value is sent whenever a request is made to the same host name.

The browser performs a tail comparison of this value and the host name to which a request is sent (meaning it starts the comparison from the end of the string) and sends the corresponding Cookie header when there’s a match.

The value set for the domain option must be part of the host name that is sending the Set-Cookie header. Invalid domain options are simply ignored.

Set-Cookie: name=Nicholas; path=/blog

A secure cookie will only be sent to the server when a request is made using SSL and the HTTPS protocol. The idea that the contents of the cookie are of high value and could be potentially damaging to transmit as clear text.

In reality, confidential or sensitive information should never be stored or transmitted in cookies as the entire mechanism is inherently insecure. By default, cookies set over an HTTPS connection are automatically set to be secure.


However, due to the browser mechanism to set and read cookies, they can be used as spyware (see zombie cookie and evercookie for more details). Anti-spyware products may warn users about some cookies because cookies can be used to track computer activity—a privacy concern, later causing possible malware.

https://en.wikipedia.org/wiki/HTTP_cookie
Zombie cookie
Zombie cookies are cookies that are automatically recreated after being deleted. This is accomplished with the help of a client-side script. The script starts by storing the cookie's content in multiple locations, such as Flash local storage, HTML5 storage, and other client-side storage locations. When the script detects the cookie's absence, it recreates the cookie using the data stored in these locations.