Set a maximum lifetime in sessions
Summary​
Application sessions should have a maximum lifetime, regardless of the user activity (absolute timeout).
Description​
Implementing an absolute timeout for application sessions is a security control applied to mitigate the risks associated with session hijacking or unauthorized access. It sets a limit on how long a user's session can persist on the system, regardless of their level of activity within the application. It helps to ensure that even if a user forgets to log out there is a maximum duration for which an attacker could exploit the session.
Supported In​
This requirement is verified in following services
Plan | Supported |
---|---|
Essential | 🔴 |
Advanced | 🟢 |
References​
- NIST 800-53-AC-12. Session termination
- OWASP TOP 10-A7. Identification and authentication failures
- PA-DSS-5_2_10. Broken authentication and session management
- CMMC-IA_L2-3_5_6. Identifier handling
- HITRUST CSF-01_u. Limitation of connection time
- ISA/IEC 62443-CR-3_1-RE_1. Communication authentication
- WASC-W_47. Insufficient session expiration
- OWASP Top 10 Privacy Risks-P8. Missing or insufficient session expiration
- OWASP SCP-4. Session management
- CWEâ„¢-613. Insufficient session expiration
- FISMA-AC-12. Session termination
Vulnerabilities​
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.