In this article, we survey the most common attacks against web sessions, that is, attacks that
target honest web browser users establishing an authenticated session with a trusted web …

Web-based single sign-on (SSO) services such as Google Sign-In and Log In with Paypal
are based on the OpenID Connect protocol. This protocol enables so-called relying parties …

In the last few years, many security researchers proposed to endow the web platform with
more rigorous foundations, thus allowing for a precise reasoning on web security issues …

Session cookies constitute one of the main attack targets against client authentication on the
Web. To counter these attacks, modern web browsers implement native cookie protection …

Web sessions are fragile and can be attacked at many different levels. Classic attacks like
session hijacking, session fixation and cross-site request forgery are particularly dangerous …

We present WPSE, a browser-side security monitor for web protocols designed to ensure
compliance with the intended protocol flow, as well as confidentiality and integrity properties …

Browser-based defenses have recently been advocated as an effective mechanism to
protect potentially insecure web applications against the threats of session hijacking …

Since cookies act as the only proof of a user identity, web sessions are particularly
vulnerable to session hijacking attacks, where the browser run by a given user sends …

Even though their architecture relies on robust security principles, it is well-known that poor
programming practices may expose browser extensions to serious security flaws, leading to …

The complexity of browsers has steadily increased over the years, driven by the continuous
introduction and update of Web platform components, such as novel Web APIs and security …