Multiple choice › Session management
Session management
1. Session management
Which practice BEST improves the security of user sessions?
- Use the same session ID for every user
- Expire sessions after a period of inactivity and generate a new session ID on login
- Keep users logged in forever so they do not need to re-enter passwords
- Put the session ID in the web address so it is easy to share
Answer
B
Short-lived, unpredictable session IDs that are regenerated at login reduce hijacking and fixation risk.