CWE-1463 詳細

The product establishes an authenticated user session, but it does not properly set a timeout for the session. That is, the timeout is set to an excessively large value or is not set at all.

導入モード

Implementation

適用可能なプラットフォーム

言語

クラス： Not Language-Specific (Undetermined)

オペレーティングシステム

クラス： Not OS-Specific (Undetermined)

アーキテクチャ

クラス： Not Architecture-Specific (Undetermined)

テクノロジー

クラス： Client Server (Undetermined)
クラス： Web Based (Undetermined)

一般的な結果

観察された例

潜在的な緩和策

Phases : Implementation
Ensure that user sessions have appropriate absolute timeouts set. The industry standard is between 4 and 8 hours for an absolute timeout [REF-1540].
Phases : Implementation
Ensure that user sessions have appropriate inactivity timeouts set. 2 to 5 minutes is recommended for high-value applications, and 15-30 minutes for low-risk applications [REF-1540].
Phases : Implementation
If using an authentication token for a user session, ensure that the token lifetime is configured based on the recommended best practices from the token provider [REF-1563]. There are situations using authentication tokens such as a JWT (Java Web Token) in which the server-side does not handle session timeouts and trusts the values directly from the token. In this case, it is important that the timeout value is set correctly for the token that is granted.

脆弱性マッピングノート

理由 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction. Do not map to this CWE in situations where the timeout value is set, but the session is incorrectly invalidated; use CWE-1464 instead.

ノート

This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases.

参考文献

REF-1520

Insufficient Session Expiration
WASC.
http://projects.webappsec.org/w/page/13246944/Insufficient%20Session%20Expiration

REF-1540

Session Management Cheat Sheet
OWASP.
https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

REF-1561

OWASP Web Security Testing Guide: 4.6 Session Management Testing
OWASP.
https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/06-Session_Management_Testing/

REF-1562

Session Timeout
OWASP.
https://community.owasp.org/Session_Timeout

REF-1563

Access Token Lifetime
OAUTH.
https://www.oauth.com/oauth2-servers/access-tokens/access-token-lifetime/

REF-1564

Antipattern: Set a long expiration time for OAuth tokens
Google.
https://docs.cloud.google.com/apigee/docs/api-platform/antipatterns/oauth-long-expiration

登録情報