Cornucopia - Ecommerce Website - SM 10

Suit: Session management

Card/Value: 10

Description:
Marce can forge requests because per-session, or per-request for more critical actions, strong random tokens (i.e. anti-CSRF tokens) or similar are not being used for actions that change state.

Technical Note:
Consider supplementing standard session management with:
 * Per-session strong random tokens or parameters.
 * Per-request, as opposed to per-session, strong random tokens or parameters.

References:
« Previous Card | Session management | Next Card »