Update: Session_Management_Cheat_Sheet

[randomstuff]

What is missing or needs to be updated?

The session management cheat sheet lacks guidance regarding how to store and validate session token (and similar tokens) server-side:

• store the session token server-side ;
• store hash of the session token server-side ;
• use (session_id, MAC-or-sign(session_id)) as cookie and store session_id server-side;
• use session_id as cookie and store hash(session_id) server-side;
• use (session_id, session_verifier) as cookie and store (session_id, hash(session_verifier)) server-side.

How should this be resolved?

[R0h1t3]

@randomstuff I am currently reading through the OWASP Cheat Sheet Series. Can I work on this? I have a few ideas on how to store and validate them.

[jmanico]

Yes, please! This is all on GitHub and we take PR’s!

[R0h1t3]

@jmanico I am pretty new to GitHub contribution, so what should I do now? Should I clone the session management cheatsheet, make changes to it and give a pull request or what to do? Kindly guide me through.

[kwwall]

Probably easiest way is to fork it, then clone THAT, make changes, commit, and push to your repo (vs the original upstream one) and then create a PR from your repo.

[randomstuff]

See for example, "How to securely store and use session IDs" on Information Security Stack Exchange.