Session Management Cheat Sheet available
The Session Management Cheat Sheet is available in the OWASP series covering session management controls.
OWASP Cheat Sheets · all subjects
session management
10 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
SameSite cookie attribute prevents clickjacking for authenticated attacks
Cookies with a SameSite attribute of either strict or lax will not be included in requests made to a page within an iframe. If session cookies are marked as SameSite, any clickjacking attack that requires the victim to be authenticated will not work, as the cookie will not be sent.
Session-based DoS defense: limit server-side session timeouts
Limit server-side session time based on inactivity and enforce a final absolute timeout. Session timeouts prevent resource exhaustion by freeing up resources when users are inactive.
Session-based DoS defense: limit session data storage
Limit the amount of data bound to each session. The less data linked to a session, the less burden on webserver performance and the better resilience against resource exhaustion.
Mobile remote logout feature
Offer a remote logout feature in mobile applications to allow users to end sessions remotely.
Mobile session timeout after inactivity
Sessions should timeout after inactivity in mobile applications.
Mobile session token randomization
Use randomly generated session tokens in mobile applications.
Mobile session data security
Secure session data on both client and server side in mobile applications.
V3.3 Session Logout and Timeout references Session Management Cheat Sheet
For session logout and timeout covered under V3.3 Session Logout and Timeout Requirements, OWASP references the Session Management Cheat Sheet.
Session management cheat sheet reference
The OWASP ASVS index references the Session Management Cheat Sheet as the primary resource for V7 Session Management, appearing in all subsections (V7.1 through V7.6).