V7 Session Management Control Objective
Session management mechanisms allow applications to correlate user and device interactions over time, even when using stateless communication protocols such as HTTP. Modern applications may use multiple session tokens with distinct characteristics and purposes. A secure session management system prevents attackers from obtaining, utilizing, or abusing a victim's session. Applications maintaining sessions must ensure sessions are unique to each individual and cannot be guessed or shared, and that sessions are invalidated when no longer required and timed out during periods of inactivity.
V7.1.1 Session inactivity timeout and absolute maximum lifetime documentation
Requirement 7.1.1 applies at Level 2. The application must verify that the user's session inactivity timeout and absolute maximum session lifetime are documented, are appropriate in combination with other controls, and that the documentation includes justification for any deviations from NIST SP 800-63B re-authentication requirements.
V7.1.2 Concurrent sessions documentation
Requirement 7.1.2 applies at Level 2. The application must verify that the documentation defines how many concurrent (parallel) sessions are allowed for one account as well as the intended behaviors and actions to be taken when the maximum number of active sessions is reached.
V7.1.3 Federated identity and SSO session documentation
Requirement 7.1.3 applies at Level 2. The application must verify that all systems that create and manage user sessions as part of a federated identity management ecosystem (such as SSO systems) are documented along with controls to coordinate session lifetimes, termination, and any other conditions that require re-authentication.
V7.2.1 Backend session token verification
Requirement 7.2.1 applies at Level 1. The application must verify that session token verification is performed using a trusted, backend service.
V7.2.2 Dynamic session tokens instead of static secrets
Requirement 7.2.2 applies at Level 1. The application must verify that it uses either self-contained or reference tokens that are dynamically generated for session management, not using static API secrets and keys.
V7.2.3 Reference token generation with CSPRNG and entropy
Requirement 7.2.3 applies at Level 1. The application must verify that if reference tokens are used to represent user sessions, they are unique and generated using a cryptographically secure pseudo-random number generator (CSPRNG) and possess at least 128 bits of entropy.
V7.2.4 New session token generation on authentication
Requirement 7.2.4 applies at Level 1. The application must verify that it generates a new session token on user authentication, including re-authentication, and terminates the current session token.
V7.3.1 Inactivity timeout enforcement
Requirement 7.3.1 applies at Level 2. The application must verify that there is an inactivity timeout such that re-authentication is enforced according to risk analysis and documented security decisions.
V7.3.2 Absolute maximum session lifetime
Requirement 7.3.2 applies at Level 2. The application must verify that there is an absolute maximum session lifetime such that re-authentication is enforced according to risk analysis and documented security decisions.
V7.4.1 Session termination effectiveness
Requirement 7.4.1 applies at Level 1. The application must verify that when session termination is triggered (such as logout or expiration), it disallows any further use of the session. For reference tokens or stateful sessions, this means invalidating the session data at the application backend. Applications using self-contained tokens require a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time, or rotating a per-user signing key.
V7.4.2 Session termination on account disable or deletion
Requirement 7.4.2 applies at Level 1. The application must verify that it terminates all active sessions when a user account is disabled or deleted (such as an employee leaving the company).
V7.4.3 Terminate other sessions after authentication factor change
Requirement 7.4.3 applies at Level 2. The application must verify that it gives the option to terminate all other active sessions after a successful change or removal of any authentication factor (including password change via reset or recovery and, if present, an MFA settings update).
V7.4.4 Logout functionality visibility and accessibility
Requirement 7.4.4 applies at Level 2. The application must verify that all pages that require authentication have easy and visible access to logout functionality.
V7.4.5 Administrator session termination capability
Requirement 7.4.5 applies at Level 2. The application must verify that application administrators are able to terminate active sessions for an individual user or for all users.
V7.5.1 Re-authentication for sensitive account attribute modification
Requirement 7.5.1 applies at Level 2. The application must verify that it requires full re-authentication before allowing modifications to sensitive account attributes which may affect authentication such as email address, phone number, MFA configuration, or other information used in account recovery.
V7.5.2 User view and terminate active sessions
Requirement 7.5.2 applies at Level 2. The application must verify that users are able to view and (having authenticated again with at least one factor) terminate any or all currently active sessions.
V7.5.3 Additional authentication for highly sensitive transactions
Requirement 7.5.3 applies at Level 3. The application must verify that it requires further authentication with at least one factor or secondary verification before performing highly sensitive transactions or operations.
V7.6.1 Federated session lifetime and termination between RP and IdP
Requirement 7.6.1 applies at Level 2. The application must verify that session lifetime and termination between Relying Parties (RPs) and Identity Providers (IdPs) behave as documented, requiring re-authentication as necessary such as when the maximum time between IdP authentication events is reached.
V7.6.2 Session creation requiring user consent or explicit action
Requirement 7.6.2 applies at Level 2. The application must verify that creation of a session requires either the user's consent or an explicit action, preventing the creation of new application sessions without user interaction.