Measuring Web Session Security at Scale

Session management is a particularly delicate component of web applications, which might suffer from range severe security issues, including impersonation attacks. Unfortunately, the scope and significance prior work on session in wild are limited by complexity attack surface challenges automating login process existing websites. In present article, we fill this gap proposing first comprehensive, large-scale measurement based post-login data. Our analysis comprehensive that it deals with all key aspects sessions, i.e., process, logout authentication cookie handling. automated approach analysed an extensive set practices over 6,000 sites where was successful cookies could be automatically detected, uncovering widespread adoption insecure wild.