RequestRodeo: Client Side Protection against Session Riding

The term Session Riding denotes a class of attacks on web applications that exploit implicit authentication processes. There are four distinct methods of implicit authentication found in today’s web applications: Cookies, http authentication, IP address based access control and client side SSL authentication. As many web applications fail to protect their users against Session Riding attacks we introduce RequestRodeo, a client side solution to counter this threat. With the exception of client side SSL, RequestRodeo implements protection against the exploitation of implicit authentication mechanisms. This protection is achieved by removing authentication information from suspicious requests.