SESSION MANAGEMENT (SM7)
Graham can utilize Adam's session after he has finished, because there is no log out function, or he cannot easily log out, or log out does not properly terminate the session
Graham can utilize Adam's session after he has finished, because there is no log out function, or he cannot easily log out, or log out does not properly terminate the session
OWASP SCP
62,63
OWASP ASVS
3.3.1,3.3.4
OWASP AppSensor
CAPEC
-
SAFECODE
28
Users should be able to log out from any pages protected by access control (authentication and authorisation checks). The logout functionality should fully terminate the associated session or connection such that the session identifier is no longer usable.
Mappings
OWASP ASVS (4.0): 3.3.1 ,3.3.4
Capec: 21
OWASP SCP: 62,63
OWASP Appsensor:
Safecode: 28
ASVS (4.0) Cheatsheetseries Index
ASVS V3.3 - Session Logout and Timeout Requirements
No suitable mappings were found.
