CON.10.A3 Secure Session Management (B)

Developers MUST ensure that session IDs are protected appropriately. Session IDs MUST be generated randomly and with sufficient entropy. If the web application framework in use can generate secure session IDs, the Developers MUST use this feature. The security-relevant configuration options of the framework MUST be considered. If session IDs are transmitted and stored by the clients, they MUST be transmitted with sufficient protection.

A web application MUST provide users with the option to expressly terminate an active session. After a user has logged in, any existing session ID MUST be replaced by a new one. Sessions MUST have a maximum validity period (timeout). Inactive sessions MUST automatically expire after a specified period of time. After a session has become invalid, all the session data MUST be rendered invalid and deleted.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)