SESSION MANAGEMENT (SM9)
Ivan can steal session identifiers because they are sent over insecure channels, or are logged, or are revealed in error messages, or are included in URLs, or are accessible un-necessarily by code which the attacker can influence or alter
Ivan can steal session identifiers because they are sent over insecure channels, or are logged, or are revealed in error messages, or are included in URLs, or are accessible un-necessarily by code which the attacker can influence or alter
OWASP SCP
69,75,76,119,138
OWASP ASVS
1.9.1,3.1.1,7.1.1,7.1.2,7.2.1,9.1.3,9.2.2
OWASP AppSensor
SE4,SE5,SE6
CAPEC
-
SAFECODE
28
Protect session identifiers as if they are account credentials. For HTTP cookies:
Set cookies with the HttpOnly attribute, unless you specifically require client-side scripts within your application to read or set a cookie's value. Set the 'secure' attribute for cookies transmitted over an TLS connection. Consider making the whole ecommerce website 'SSL-only', adding the HTTP Strict Transport Security (HSTS) header and adding the domain to web browser pre-load lists.
Mappings
OWASP ASVS (4.0): 1.9.1 ,3.1.1 ,7.1.1 ,7.1.2 ,7.2.1 ,9.1.3 ,9.2.2
OWASP SCP: 69,75,76,119,138
OWASP Appsensor: SE4,SE5,SE6
Safecode: 28
ASVS (4.0) Cheatsheetseries Index
ASVS V1.9 - Communications Architectural Requirements
ASVS V3.1 - Fundamental Session Management Requirements
ASVS V7.1 - Log Content Requirements
ASVS V7.2 - Log Processing Requirements
ASVS V9.1 - Communications Security Requirements
ASVS V9.2 - Server Communications Security Requirements
No suitable mappings were found.
