Question

Explain Session Management in your OWN words.

Answer 1

• is the process of securing multiple requests to a service from an equivalent user or entity. In many cases, a session is initialized by authenticating a user or entity with factors like a password. Once the user is authenticated, subsequent requests authenticate the session as against the user themselves.

How does it work:-

• Session Id: Users prove they own a session by submitting authentication parameters with each request that typically include a session id and other factors like a nonce. Session ids are designed to be long and random such it's infeasible to guess them.
• Transport: Session management is actually a process of providing secrets to authenticated users like a session id and having them pass it back to you. As such, cryptographically secure network communications are required to implement secure session management.
• Cookies:The security of clients may be a concern for session management. In the case of an internet browser, session ids could also be stored in secure cookies. In some cases, browsers are often tricked into abandoning their session credentials with attacks like DNS spoofing.
• Session expiry:-Session are design as they are used for only limited time duratio. So after every request their life will be extended
• Session resources:- Session managment can be easily targeted by denial of service attack which flood service for request to create new session
• Detecting anomalies:-Session managment included some features like brute force or predicting of denial of service attack. It also prevent the user from creating multiple sessions using same ip address