\begin{enumerate}[label={3.\arabic*}]

    \item
    \TODO{}
    Verify that there is no custom session manager, or that the custom session
    manager is resistant against all common session management attacks.

    \item
    \TODO{}
    Verify that sessions are invalidated when the user logs out.

    \item
    \TODO{}
    Verify that sessions timeout after a specified period of inactivity.

  \notapplicable{
    \item
    Verify that sessions timeout after an administratively-configurable
    maximum time period regardless of activity (an absolute timeout).
  }

    \item
    \TODO{}
    Verify that all pages that require authentication have easy and visible
    access to logout functionality.

    \item
    \TODO{}
    Verify that the session id is never disclosed in URLs, error messages, or
    logs. This includes verifying that the application does not support URL
    rewriting of session cookies.

    \item
    \TODO{}
    Verify that all successful authentication and re-authentication generates
    a new session and session id.

  \notapplicable{
    \item
    Verify that only session ids generated by the application framework are
    recognized as active by the application.
  }

    \item
    \TODO{}
    Verify that session ids are sufficiently long, random and unique across the
    correct active session base.

    \item
    \TODO{}
    Verify that session ids stored in cookies have their path set to an
    appropriately restrictive value for the application, and authentication
    session tokens additionally set the “HttpOnly” and “secure” attributes.

    \item
    \TODO{}
    Verify that the application limits the number of active concurrent sessions.

    \item
    \TODO{}
    Verify that an active session list is displayed in the account profile or
    similar of each user. The user should be able to terminate any active
    session.

    \item
    \TODO{}
    Verify the user is prompted with the option to terminate all other active
    sessions after a successful change password process.

\end{enumerate}
