Weakness (CWE)
CWE-1463: Insufficient Session Timeout Value
The product establishes an authenticated user session, but it does not properly set a timeout for the session. That is, the timeout is set to an excessively large value or is not set at all.
How to prevent it (3 mitigations)
-
Implementation
Ensure that user sessions have appropriate absolute timeouts set. The industry standard is between 4 and 8 hours for an absolute timeout [REF-1540].
-
Implementation
Ensure that user sessions have appropriate inactivity timeouts set. 2 to 5 minutes is recommended for high-value applications, and 15-30 minutes for low-risk applications [REF-1540].
-
Implementation
If using an authentication token for a user session, ensure that the token lifetime is configured based on the recommended best practices from the token provider [REF-1563]. There are situations using authentication tokens such as a JWT (Java Web Token) in which the server-side does not handle session timeouts and trusts the values directly from the token. In this case, it is important that the timeout value is set correctly for the token that is granted.
Source: MITRE CWE-1463
0 results · Clear filters · Feed