Bifurcated Web Session Authentication Against Cookie Replay
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web-based applications face security vulnerabilities as session cookies can be easily stolen or replayed, allowing unauthorized access to secure sessions, compromising both the application and user data.
Innovation Solution
Implementing a bifurcated authentication system where a web browser stores session cookies and authentication information separately, with the web-based application periodically pushing authentication information to the browser, ensuring that even if a hacker gains access to the session cookie, they cannot access the secured session without the matching authentication information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If session cookies are used to maintain secure sessions, then ease of operation is improved, but security is worsened due to cookie theft and replay attacks
Solution Approach 1:
The authentication system is segmented into two separate components: session cookies stored in the browser and authentication information stored securely on the server. This segmentation ensures that even if cookies are stolen, the authentication information remains protected on the server, preventing unauthorized session access while maintaining ease of operation through cookie-based session management.
2Reliability
If authentication information is stored only on the server, then security is improved, but device complexity increases due to periodic push requirements
Solution Approach 1:
The server automatically pushes authentication information to the browser without requiring manual user intervention. This self-service mechanism maintains high security by keeping authentication information server-controlled while minimizing device complexity through automated background processes that reduce user burden.
3Reliability
If a bifurcated authentication system is implemented, then security is improved, but ease of operation is worsened due to separate storage requirements
Solution Approach 1:
The browser acts as an intermediary between the user and the server, automatically managing the bifurcated authentication system. It stores session cookies for seamless user access while receiving and managing authentication information from the server, thereby improving session protection without significantly impacting user experience through automated background operations.
Data Source
AI summary
A system for providing enhanced web browser security that leverages a bifurcated web-based application authentication system. The system may include a web-based application configured to, after authentication of login information, generate a session cookie authentication information. The authentication information may match some or all of the data stored in the session cookie. The system may include a web browser configured to store the session cookie in a folder designated for storage of session cookies. The web browser may be further configured to add a new object to a DOM document hierarchy, the new object storing the authentication information. The web browser may be further configured to repeatedly push, to the web-based application, the authentication information upon the lapse of a time interval.