Difference between revisions of "OWASP Periodic Table of Vulnerabilities - Insufficient Session Expiration"

From OWASP
Jump to: navigation, search
(Removed detailed description (references are intended to be used if the reader needs more information about the vulnerability) and simplified root cause description. Added requirement for working logout button to generic framework solution.)
m
 
(One intermediate revision by one user not shown)
Line 25: Line 25:
  
 
=== Discussion / Controversy ===
 
=== Discussion / Controversy ===
Although most web frameworks support idle timeout and few web frameworks support absolute timeout, there are cases where both of these conjectures are not true. Custom session handling mechanisms require much of this logic to be implemented "by hand".
+
Although most web frameworks support idle timeout and few web frameworks support absolute timeout, there are cases where both of these conjectures are not true. Custom session handling mechanisms require much of this logic to be implemented "by hand". Problem space overlap current working group specifications for HTTPAuth and WebSec.
  
 
=== References ===
 
=== References ===
 
[https://www.owasp.org/index.php/Session_Management_Cheat_Sheet Session Management Cheat Sheet]<br>
 
[https://www.owasp.org/index.php/Session_Management_Cheat_Sheet Session Management Cheat Sheet]<br>
 +
[http://projects.webappsec.org/w/page/13246944/Insufficient%20Session%20Expiration Insufficient Session Expiration (WASC)]<br>
 +
[http://cwe.mitre.org/data/definitions/613.html Insufficient Session Expiration (CWE)]

Latest revision as of 19:20, 15 November 2013

Return to Periodic Table Working View

Contents

Insufficient Session Expiration

Root Cause Summary

The application either does not implement an inactivity timeout or an absolute timeout, or the timeouts are too long to provide sufficient risk mitigation. The application does not provide a logout feature, or the feature does not actively terminate the user's session.

Browser / Standards Solution

Currently, session management is normally implemented with cookies and web frameworks that are custom to each solution. There is work underway to define a new standard for instructing the browser about session timeouts and how to handle them.

Perimeter Solution

None

Generic Framework Solution

The framework should provide a configurable option for setting the inactivity and absolute timeouts for sessions. Timeouts should have secure defaults (e.g. 20 minutes of inactivity, 8 hours absolute lifetime). The framework should provide a configuration option to automatically save session state and allow the session to continue if the user successfully reauthenticates after the session times out.

The application should provide the user the option to log out and destroy the session immediately without waiting for either timer to expire.

Custom Framework Solution

None

Custom Code Solution

None

Discussion / Controversy

Although most web frameworks support idle timeout and few web frameworks support absolute timeout, there are cases where both of these conjectures are not true. Custom session handling mechanisms require much of this logic to be implemented "by hand". Problem space overlap current working group specifications for HTTPAuth and WebSec.

References

Session Management Cheat Sheet
Insufficient Session Expiration (WASC)
Insufficient Session Expiration (CWE)