report/v3_session.tex

   1 \begin{enumerate}[label={3.\arabic*}]
   2
   3     \item
   4     \TODO{}
   5     Verify that there is no custom session manager, or that the custom session
   6     manager is resistant against all common session management attacks.
   7
   8     \item
   9     \TODO{}
  10     Verify that sessions are invalidated when the user logs out.
  11
  12     \item
  13     \TODO{}
  14     Verify that sessions timeout after a specified period of inactivity.
  15
  16   \notapplicable{
  17     \item
  18     Verify that sessions timeout after an administratively-configurable
  19     maximum time period regardless of activity (an absolute timeout).
  20   }
  21
  22     \item
  23     \TODO{}
  24     Verify that all pages that require authentication have easy and visible
  25     access to logout functionality.
  26
  27     \item
  28     \TODO{}
  29     Verify that the session id is never disclosed in URLs, error messages, or
  30     logs. This includes verifying that the application does not support URL
  31     rewriting of session cookies.
  32
  33     \item
  34     \TODO{}
  35     Verify that all successful authentication and re-authentication generates
  36     a new session and session id.
  37
  38   \notapplicable{
  39     \item
  40     Verify that only session ids generated by the application framework are
  41     recognized as active by the application.
  42   }
  43
  44     \item
  45     \TODO{}
  46     Verify that session ids are sufficiently long, random and unique across the
  47     correct active session base.
  48
  49     \item
  50     \TODO{}
  51     Verify that session ids stored in cookies have their path set to an
  52     appropriately restrictive value for the application, and authentication
  53     session tokens additionally set the “HttpOnly” and “secure” attributes.
  54
  55     \item
  56     \TODO{}
  57     Verify that the application limits the number of active concurrent sessions.
  58
  59     \item
  60     \TODO{}
  61     Verify that an active session list is displayed in the account profile or
  62     similar of each user. The user should be able to terminate any active
  63     session.
  64
  65     \item
  66     \TODO{}
  67     Verify the user is prompted with the option to terminate all other active
  68     sessions after a successful change password process.
  69
  70 \end{enumerate}