Session management q
Every part of the application and type of request should verify that the user has a valid current session (if required) and thus their privileges, before undertaking any other data validation and processing.
NB: This relates to application-wide session management control. See SM K for what session management routines to use.
Salim can bypass session management because it is not applied comprehensively and consistently across the application
Mappings
Owasp ASVS (4.0): 1.1.6 ,3.7.1
Capec: 21
Owasp SCP: 58
Owasp Appsensor:
Safecode: 14,28
ASVS (4.0) Cheatsheetseries Index
ASVS V1.1 - Secure Software Development Lifecycle Requirements
ASVS V3.7 - Defenses Against Session Management Exploits
Attacks
Password Guessing/Brute Force Attacks
Session Hijacking (Man-in-the-Middle)
Loading comments 0%
