new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

logging/session_management

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

session_created event logging

Log creation of authenticated sessions with event name 'session_created' followed by userid. Level is INFO. Example: event='session_created:joebob1'.

session_renewed event logging

Log when a user extends an expiring session with event name 'session_renewed' followed by userid. Level is INFO. Systems with highly confidential data may require additional verification to extend sessions.

session_expired event logging with reason

Log session expiry with event name 'session_expired' followed by userid and reason. Level is INFO. Reason codes include: logout, timeout, revoked, etc. Sessions should be expired rather than deleted.

session_logout event logging

Log explicit user logout with event name 'session_logout' followed by userid and sessionid. Level is INFO. This is a more explicit alternative to session_expired:[userid,logout]. Example: event='session_logout:joebob1,kx12ab'.

session_use_after_expire event logging

Log attempts to use the application with an expired session with event name 'session_use_after_expire' followed by userid. Level is CRITICAL. This could indicate session hijacking or unauthorized access to another person's machine/browser.

Give your agent this brain