SESSION MANAGEMENT (SMX)
Marce can forge requests because per-session, or per-request for more critical actions, strong random tokens (i.e. anti-CSRF tokens) or similar are not being used for actions that change state
Marce can forge requests because per-session, or per-request for more critical actions, strong random tokens (i.e. anti-CSRF tokens) or similar are not being used for actions that change state
OWASP SCP
73,74
OWASP ASVS
4.2.2
OWASP AppSensor
IE4
CAPEC
-
SAFECODE
18
echnical Note: Consider supplementing standard session management with:
Per-session strong random tokens or parameters. Per-request, as opposed to per-session, strong random tokens or parameters.
Mappings
OWASP ASVS (4.0): 4.2.2
OWASP SCP: 73,74
OWASP Appsensor: IE4
Safecode: 18
ASVS (4.0) Cheatsheetseries Index
ASVS V4.2 - Operation Level Access Control
No suitable mappings were found.
