CWE-1463 Detail

The product establishes an authenticated user session, but it does not properly set a timeout for the session. That is, the timeout is set to an excessively large value or is not set at all.

Modes Of Introduction

Implementation

Applicable Platforms

Language

Class: Not Language-Specific (Undetermined)

Operating Systems

Class: Not OS-Specific (Undetermined)

Architectures

Class: Not Architecture-Specific (Undetermined)

Technologies

Class: Client Server (Undetermined)
Class: Web Based (Undetermined)

Common Consequences

Observed Examples

Potential Mitigations

Phases : Implementation
Ensure that user sessions have appropriate absolute timeouts set. The industry standard is between 4 and 8 hours for an absolute timeout [REF-1540].
Phases : Implementation
Ensure that user sessions have appropriate inactivity timeouts set. 2 to 5 minutes is recommended for high-value applications, and 15-30 minutes for low-risk applications [REF-1540].
Phases : Implementation
If using an authentication token for a user session, ensure that the token lifetime is configured based on the recommended best practices from the token provider [REF-1563]. There are situations using authentication tokens such as a JWT (Java Web Token) in which the server-side does not handle session timeouts and trusts the values directly from the token. In this case, it is important that the timeout value is set correctly for the token that is granted.

Vulnerability Mapping Notes

Justification : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comment : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction. Do not map to this CWE in situations where the timeout value is set, but the session is incorrectly invalidated; use CWE-1464 instead.

Notes

This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases.

References

REF-1520

Insufficient Session Expiration
WASC.
http://projects.webappsec.org/w/page/13246944/Insufficient%20Session%20Expiration

REF-1540

Session Management Cheat Sheet
OWASP.
https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

REF-1561

OWASP Web Security Testing Guide: 4.6 Session Management Testing
OWASP.
https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/06-Session_Management_Testing/

REF-1562

Session Timeout
OWASP.
https://community.owasp.org/Session_Timeout

REF-1563

Access Token Lifetime
OAUTH.
https://www.oauth.com/oauth2-servers/access-tokens/access-token-lifetime/

REF-1564

Antipattern: Set a long expiration time for OAuth tokens
Google.
https://docs.cloud.google.com/apigee/docs/api-platform/antipatterns/oauth-long-expiration

Submission