hi,
The basic rule of thumb is that never rely on session control
mechanism at the client side such as using javascript because all the
client side implementations are subject to malicious users' control.
Normally server-side invalidation of session ID after a specific
period of idle time is a recommended practice. The exact length of
this idle time is really subject to the sensitivity and security
requirement of the application.
regards,
Rick Zhong
On 9/15/06, Matteo Nava <ilnava@gmail.com> wrote:
Hi,
Normally in web application, when a user end his session, not logging
out, but simply closing the browser, the session token stay valid
until the session timed out, and so it's potentially reusable.
In my opinion it's recommendable that some kind of a mechanism is
implemented for invalidate the session token when user close the
browser, for example, with a client side javascript code using the
onunload event to invalidate the session token. But I haven't found a
best practices or any other discussion about this problem.
Best Regards,
Matteo Nava
-------------------------------------------------------------------------
Sponsored by: Watchfire
Securing a web application goes far beyond testing the application using
manual processes, or by using automated systems and tools. Watchfire's
"Web Application Security: Automated Scanning or Manual Penetration
Testing?" whitepaper examines a few vulnerability detection methods -
specifically comparing and contrasting manual penetration testing with
automated scanning tools. Download it today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------
-------------------------------------------------------------------------
Sponsored by: Watchfire
Securing a web application goes far beyond testing the application using
manual processes, or by using automated systems and tools. Watchfire's
"Web Application Security: Automated Scanning or Manual Penetration
Testing?" whitepaper examines a few vulnerability detection methods -
specifically comparing and contrasting manual penetration testing with
automated scanning tools. Download it today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------
