+CON.10.A3 Secure Session Management (B)

CON.10.A3 Secure Session Management (B)

Developers MUST ensure that session IDs are protected appropriately. Session IDs MUST be generated randomly and with sufficient entropy. If the web application framework in use can generate secure session IDs, the Developers MUST use this feature. The security-relevant configuration options of the framework MUST be considered. If session IDs are transmitted and stored by the clients, they MUST be transmitted with sufficient protection.

A web application MUST provide users with the option to expressly terminate an active session. After a user has logged in, any existing session ID MUST be replaced by a new one. Sessions MUST have a maximum validity period (timeout). Inactive sessions MUST automatically expire after a specified period of time. After a session has become invalid, all the session data MUST be rendered invalid and deleted.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania

3. Powiązane regulacje

Regulacje

Powiązane zgłoszenia

Powiązania
blocks G 0.28 Software Vulnerabilities or Errors