Contents
V5617. OWASP. Assigning potentially negative or large value as timeout of HTTP session can lead to excessive session expiration time.
The analyzer detected code that specifies an infinite or a very long session expiration time. This can cause problems and expose the authenticated user's data.
Errors related to incorrectly set session expiration time are in the following OWASP Top 10 Application Security Risks categories:
- A2:2017-Broken Authentication on the 2017 list;
- A7:2021-Identification and Authentication Failures on the 2021 list.
Example 1:
public void ConfigureSession(HttpContext current, ....)
{
HttpSessionState session = current.Session;
session.Timeout = -1;
....
}The 'HttpSessionState.Timeout' property value stands for the session expiration time in minutes.
Assigning a negative value to the 'Timeout' property can potentially set the timeout to a potentially infinite period. This means, that if a user does not log out correctly, their private data can be compromised. For example, the next person who uses the same computer can access that user's data, because the original user is still authenticated, the session hasn't been terminated and is still active.
In some other case, an attacker can steal an authentication token and, if the timeout is potentially infinite, that attacker will have more time to perform unauthorized access. Someone can steal an authentication token by, for example, perform an XSS attack.
Example 2:
public void ConfigureSession(HttpContext current, ....)
{
HttpSessionState session = current.Session;
session.Timeout = 120;
....
}This example is similar to the first one: it is a threat, and its vulnerability can be exploited.
The analyzer considers code to be correct if the timeout is set to a period of under two hours:
public void ConfigureSession(HttpContext current, ....)
{
HttpSessionState session = current.Session;
session.Timeout = 30;
....
}Most libraries and frameworks set the default timeout value to 30 minutes or less.
The analyzer issues a Medium-level warning if the timeout value is too high and a High-level warning if the timeout is infinite.
This diagnostic is classified as:
|
Was this page helpful?
