Skip to main content

Set a maximum lifetime in sessions

Summary​

Application sessions should have a maximum lifetime, regardless of the user activity (absolute timeout).

Description​

Implementing an absolute timeout for application sessions is a security control applied to mitigate the risks associated with session hijacking or unauthorized access. It sets a limit on how long a user's session can persist on the system, regardless of their level of activity within the application. It helps to ensure that even if a user forgets to log out there is a maximum duration for which an attacker could exploit the session.

Supported In​

This requirement is verified in following services

PlanSupported
Essential🔴
Advanced🟢

References​

Vulnerabilities​

free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.