[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-571923-105":3,"detail-sidebar-cat-1-en-105":80,"doc-detail-571923-en":126},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":73,"head_meta":75,"extra_data":77,"updated_unix":79},105,"en","authentication-and-session-management","Authentication and Session Management","","Authentication and Session Management outlines core concepts for building secure web applications. It defines authentication, contrasts it with authorization, and explains what an authenticated session is, including session identifiers and their purpose in tracking logged-in status. The material describes how sessions are created and maintained by application servers, how session IDs work across requests, and why they must be protected. It also presents a session management workflow involving HTTPS delivery, credential submission, session creation with cookies, invalidation, and timeout handling.",{"@graph":14,"@context":72},[15,34,55],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/authentication-and-session-management/571923/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/authentication-and-session-management/571923.png","ImageObject",442,249,{"name":42,"@type":43},"Ben ","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-19","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":33},"InteractionCounter",{"@type":54},"ViewAction",{"@type":56,"mainEntity":57},"FAQPage",[58,64,68],{"name":59,"@type":60,"acceptedAnswer":61},"What is authentication?","Question",{"text":62,"@type":63},"Authentication is verification that an entity is who it claims to be.","Answer",{"name":65,"@type":60,"acceptedAnswer":66},"How is authentication different from authorization?",{"text":67,"@type":63},"Authentication verifies the identity of a user, while authorization checks whether an entity has privileges to perform a specific action.",{"name":69,"@type":60,"acceptedAnswer":70},"What is an authentication session and what does a session ID do?",{"text":71,"@type":63},"An authentication session tracks the status of a user who is logged in, using a session identifier supplied after authentication. Session IDs are random, unique, and difficult to guess, and sessions are valid only for a finite period.","https://schema.org",{"og:url":32,"og:type":74,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":76,"canonical":32},"index,follow",{"doc_id":78,"site_id":7},571923,1792262780,{"code":4,"msg":81,"data":82},"success",[83,87,92,97,102,107,112,117,122],{"id":84,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":85,"slug":86},11,90,"presentations",{"id":88,"doc_module":22,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},12,"Resumes",80,"resumes",{"id":93,"doc_module":22,"doc_module_name":25,"category_name":94,"show_sort_weight":95,"slug":96},14,"Invoices",70,"invoices",{"id":98,"doc_module":22,"doc_module_name":25,"category_name":99,"show_sort_weight":100,"slug":101},15,"Posters",60,"posters",{"id":103,"doc_module":22,"doc_module_name":25,"category_name":104,"show_sort_weight":105,"slug":106},16,"Social Media",50,"social-media",{"id":108,"doc_module":22,"doc_module_name":25,"category_name":109,"show_sort_weight":110,"slug":111},17,"Forms",40,"forms",{"id":113,"doc_module":22,"doc_module_name":25,"category_name":114,"show_sort_weight":115,"slug":116},18,"Letters",30,"letters",{"id":118,"doc_module":22,"doc_module_name":25,"category_name":119,"show_sort_weight":120,"slug":121},21,"Paper Templates",5,"papers-templates",{"id":123,"doc_module":22,"doc_module_name":25,"category_name":124,"show_sort_weight":4,"slug":125},158,"General","general-158",{"code":4,"msg":81,"data":127},{"doc_id":78,"user_id":128,"nickname":42,"user_avatar":129,"doc_module":22,"category_id":84,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":33,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":135,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":141},2336478951081,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","Authentication and Session Management  \nJIM MANICO Secure Coding Instructor [www.manicode.com](www.manicode.com)  \nA little background dirt…  \n[jim@manico.net](jim@manico.net)[ ](jim@manico.net)@manicode  \n􀀡 OWASP Global Board Member  \n􀀡 Project manager of the OWASP Cheat Sheet Series and several other OWASP projects  \n􀀡 18+ years of software development experience  \n􀀡 Author of \"Iron-Clad Java, Building Secure Web Applications”from McGraw-Hill/Oracle-Press  \n􀀡 Kauai, Hawaii Resident  \nCOPYRIGHT ©2015 MANICODE SECURITY  \n2  \nWARNING: Please do not attempt to hack any computer system without legal permission to do so. Unauthorized computer hacking is illegal and can be punishable by a range of penalties including  \nloss of job, monetary fines and possible imprisonment.  \nALSO: The Free and Open Source Software presented in these materials are examples of good secure development tools and techniques. You may have unknown legal, licensing or technical issues when making use of Free and Open Source Software. You should consult your company's policy on the use of Free and Open Source Software before making use of any software referenced in this material.  \nCOPYRIGHT ©2015  \nMANICODE SECURITY  \n3  \nAuthentication: Where are we going?  \nSession Management  \nTransport Security  \nPassword Storage  \nMulti-Factor Authentication  \nForgot Password Workflow  \nCOPYRIGHT ©2015  \nMANICODE SECURITY  \n4  \nQuestion:  \nWhat is authentication?  \nAnswer: Verification that an entity is who it claims to be  \nCOPYRIGHT ©2015  \nMANICODE SECURITY  \n5  \nQuestion:  \nWhat is the difference between authentication and authorization? Answer: Authentication verifies the identity of a user. Authorization checks if an entity has privileges to perform a function or action.  \nCOPYRIGHT ©2015  \nMANICODE SECURITY  \n6  \nQuestion:  \nWhat is an authentication session? Answer: A session is an area of memory or storage that tracks certain aspects of a users. An authenticated session tracks the status of a user who is \"logged in\" to your system. A session identifier (ID) is supplied to the entity once they are authenticated.  \nCOPYRIGHT ©2015  \nMANICODE SECURITY  \n7  \nSessions and Session IDs  \n􀀡 A session is created by an application server to track the state of authenticated users and visitors  \n􀀡 A session includes a area of memory or storage on the server and a session ID to refer to that server side session  \n􀀡 A session ID is a random, unique, and difficult to guess string ASEIUHF849J283JE874GSJWOD2374DDEOFEFK93423H  \n􀀡 Sessions and therefor session ID's are valid for a finite period of time  \n􀀡 Sessions are used by the application server on any subsequent request to verify the identity of the sender  \nSession IDs are a \"key\" to a portion of memory on the server where data and state can be stored for the corresponding active user!  \nCOPYRIGHT ©2015  \nMANICODE SECURITY  \n8  \nMore on Sessions  \n􀀡 In some applications, the session is  \ninitiated  \nonce a user identifies/authenticates themself.  \n􀀡 In other applications, the session is initiated even for anonymous users on first page visit.  \n􀀡 Session ID's are typically passed between the browser and server inan [HTTP Cookie](HTTP Cookie).  \n􀀡 The session ID is often all that is needed to prove authentication for the rest of the session.  \n􀀡 Session management is usually handled by the web framework, making it transparent to the developer.  \nThe session ID is often all that is needed to prove authentication for the rest of the session! We need to protect it!  \nCOPYRIGHT ©2015  \nMANICODE SECURITY  \n9  \nSession Management Workflow  \n1  \nStart [HTTPS](HTTPS), and deliver login form  \nPotential  \nre-authentication  \n5  \nSubmit credentials  \n2  \nLogoff or idle session timeout  \n6  \n3  \nCreate session, deliver cookie to user  \nAbsolute session timeout  \n7  \nDo cool things  \n4  \nInvalidate session  \n8  \nCOPYRIGHT ©2015  \nMANICODE SECURITY  \n10","cbCaivGT941NPQE2","https://ap.wps.com/l/cbCaivGT941NPQE2","pdf",19008446,81,"English","# Authentication: Where are we going?\n## Session Management\n## Transport Security\n## Password Storage\n## Multi-Factor Authentication\n## Forgot Password Workflow\n# Sessions and Session IDs\n## More on Sessions\n# Session Management Workflow","[{\"question\":\"What is authentication?\",\"answer\":\"Authentication is verification that an entity is who it claims to be.\"},{\"question\":\"How is authentication different from authorization?\",\"answer\":\"Authentication verifies the identity of a user, while authorization checks whether an entity has privileges to perform a specific action.\"},{\"question\":\"What is an authentication session and what does a session ID do?\",\"answer\":\"An authentication session tracks the status of a user who is logged in, using a session identifier supplied after authentication. Session IDs are random, unique, and difficult to guess, and sessions are valid only for a finite period.\"}]","Authentication and Session Management | PDF",1791924462,28]