SESSION MANAGEMENT (SMK)
Peter can bypass the session management controls because they have been self-built and/or are weak, instead of using a standard framework or approved tested module
Peter can bypass the session management controls because they have been self-built and/or are weak, instead of using a standard framework or approved tested module
OWASP SCP
58,60
OWASP ASVS
1.1.6
OWASP AppSensor
CAPEC
-
SAFECODE
14,28
Centralized session management routines are a good programming practice, but like other routines, developers need to understand how they work, how to use them and any limitations. These should preferably be the framework's in-built session management support. If third party session management libraries are used, it is important to test each routine before its implementation.
NB: This relates to what session management routines to use. See SM Q for application-wide coverage.
Mappings
OWASP ASVS (4.0): 1.1.6
Capec: 21
OWASP SCP: 58,60
OWASP Appsensor:
Safecode: 14,28
ASVS (4.0) Cheatsheetseries Index
ASVS V1.1 - Secure Software Development Lifecycle Requirements
No suitable mappings were found.
