چكيده به لاتين
With the rapid development of information and communication technology, computer networks are playing a bigger role in our life every day. In this regard, the importance of security in web applications to provide vital services such as e-banking, e-shopping, social networking, etc. is undeniable, as most of these are done via the Internet. An important requirement that must be considered, is that, in all of the above-mentioned tasks is to provide an acceptable authentication mechanism and prevent attacks such as Session Hijacking, Cross-Site Scripting, Cross-Site Request Forgery, Session Fixation and Replay attacks.
However, we see that static bearer cookies are still used in web applications to validate messages and requests throughout the authentication period. However, most of the methods currently used are vulnerable to Replay attacks and do not provide any defense mechanisms against these attacks. Also, the use of static cookies in HTTP, makes users vulnerable to all kinds of session-related attacks, such as Cross-Site Scripting, Cross-Site Request Forgery, Session Fixation and Replay attacks.
In this thesis, we show that most of the security attacks and threats mentioned above arise because static session cookies have been used to user's authentication message validation. In the thesis, a method as a countermeasure for session hijacking attacks is presented using dynamic cookies.
