Detection of logged-on users based on browser storage data

Abstract

The disclosed techniques detect when a browser user remains logged-on to a website. Knowing that a browser user remains logged-on improves posture management in the face of cyberattacks. Visibility of the attack surface improves, and insight on how to reduce attack exposure is obtained. Furthermore, knowledge of when a web browser user was logged-on to a particular website may assist in post-hoc investigation of security incidents. In some configurations, local browser storage is scanned for key-value pairs that indicate a user remains logged-on. A key that matches a particular pattern and which includes a user identifier may indicate that a user remains logged-on. Additionally, or alternatively, specific keys may be associated with values that contain the identifier of a logged-on user. A security operation may be performed to warn a responsible party or to mitigate the vulnerability.