Set a maximum lifetime in sessions
Summary
Application sessions should have a maximum lifetime, regardless of the user activity (absolute timeout).
Description
Implementing an absolute timeout for application sessions is a security control applied to mitigate the risks associated with session hijacking or unauthorized access. It sets a limit on how long a user's session can persist on the system, regardless of their level of activity within the application.
It helps to ensure that even if a user forgets to log out there is a maximum duration for which an attacker could exploit the session.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Essential | 🔴 |
| Advanced | 🟢 |
References
- NIST 800-53-AC-12. Session termination
- OWASP TOP 10-A7. Identification and authentication failures
- PA-DSS-5_2_10. Broken authentication and session management
- CMMC-IA_L2-3_5_6. Identifier handling
- HITRUST CSF-01_u. Limitation of connection time
- ISA/IEC 62443-CR-3_1-RE_1. Communication authentication
- WASC-W_47. Insufficient session expiration
- OWASP Top 10 Privacy Risks-P8. Missing or insufficient session expiration
- OWASP SCP-4. Session management
- CWEâ„¢-613. Insufficient session expiration
- FISMA-AC-12. Session termination
Vulnerabilities
Free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.