1 \begin{enumerate
}[label=
{V3.
\arabic*
}]
5 Verify that there is no custom session manager, or that the custom session
6 manager is resistant against all common session management attacks.
8 The application uses the standard
\PHP{} functionality; namely
9 \code{session
\_start ()
} to manage sessions.
15 Verify that sessions are invalidated when the user logs out.
17 When a user logs out the application calls
\code{forget()
}, which
18 invalidates the session.
24 Verify that sessions timeout after a specified period of inactivity.
26 There is absolutely no functionality which tracks how long a user has been inactive.
32 Verify that sessions timeout after an administratively-configurable
33 maximum time period regardless of activity (an absolute timeout).
38 Verify that all pages that require authentication have easy and visible
39 access to logout functionality.
41 The logout functionality is plainly visible on the top right of the
42 application on every page that requires authentication. This is defined in
43 \srcref{admin/themes/header.php
}{16-
30}
49 Verify that the session id is never disclosed in URLs, error messages, or
50 logs. This includes verifying that the application does not support URL
51 rewriting of session cookies.
53 The session id is only used inside the cookie. And the
\PHP{}
54 \code{\$
\_SESSION} variable is never accessed outside of session
55 management in
\srcref{sessions.php
}{}.
61 Verify that all successful authentication and re-authentication generates
62 a new session and session id.
64 The application does not destroy the session id upon logout, it merely
65 invalidates it. However
\PHP{}'s session managements automatically
66 invalides these session id's after some time.
% Discuss?
72 Verify that only session ids generated by the application framework are
73 recognized as active by the application.
78 Verify that session ids are sufficiently long, random and unique across the
79 correct active session base.
81 The session ids are generated by
\PHP{} trough the
\code{session
\_start}
82 function. These are indeed sufficiently long, random and unique. There are
83 no known attacks against these session ID's.
89 Verify that session ids stored in cookies have their path set to an
90 appropriately restrictive value for the application, and authentication
91 session tokens additionally set the “HttpOnly” and “secure” attributes.
93 There is just one cookie for tha application and it's path includes the whole
94 site. However this seems appropriate. The "HttpOnly" and "secure"
95 attributes are not set for this cookie.
101 Verify that the application limits the number of active concurrent sessions.
103 By using
\PHP{}'s session handling mechanism the application limits the
104 number of active concurrent sessions adequately.
109 Verify that an active session list is displayed in the account profile or
110 similar of each user. The user should be able to terminate any active
113 There is no indication whatsoever of any other active sessions a user may
119 Verify the user is prompted with the option to terminate all other active
120 sessions after a successful change password process.
122 There is no such option, also notqeable is that there is no confirmation for