Session management 4
There may be reasons to share sessions across multiple applications, but if one of those applications is less secure it might be used to compromise another.
Alison can set session identification cookies on another web application because the domain and path are not restricted sufficiently
Mappings
Owasp ASVS (4.0): 3.4.1-3.4.5
Owasp SCP: 59,61
Owasp Appsensor: SE2
Safecode: 28
ASVS (4.0) Cheatsheetseries Index
ASVS V3.4 - Cookie-based Session Management
Attacks
Password Guessing/Brute Force Attacks
Session Hijacking (Man-in-the-Middle)
Loading comments 0%
