Read more about this topic in OWASP’s free Cheat Sheets on Session Management, and Cross Site Request Forgery (CSRF) Prevention 4 5 6 7 Session Session Session Session Alison can set session John can predict or guess session Gary can take over a user's can utilize Adam's session identification cookies on another identifiers because they are not session because there is a long or after he has finished, because web application because the changed when the user's role no inactivity timeout, or a long or there is no log out function, or he Management Management Management Management domain and path are not alters (e.g. pre and post no overall session time limit, or cannot easily log out, or log out restricted sufficiently authentication) and when the same session can be used does not properly terminate the switching between non-encrypted from more than one session and encrypted communications, device/location or are not sufficiently long and random, or are not changed periodically 8 9 10 J Session Session Session Session Matt can abuse long sessions Ivan can steal session identifiers Marce can forge requests because Jeff can resend an identical repeat because the application does not because they are sent over per-session, or per-request for interaction (e.g. HTTP request, require periodic re-authentication insecure channels, or are logged, more critical actions, strong signal, button and it is Management to check if privileges have Management or are revealed in error messages, Management random tokens or similar are not Management accepted, not rejected changed or are included in URLs, or are being used for actions that accessible un-necessarily by code change state which the attacker can influence or alter
Read more about this topic in OWASP’s free Cheat Sheets on Session Management, and Cross Site Request Forgery (CSRF) Prevention Session Management 4 Session Management 5 Session Management 6 Session Management 7 Alison can set session identification cookies on another web application because the domain and path are not restricted sufficiently John can predict or guess session identifiers because they are not changed when the user's role alters (e.g. pre and post authentication) and when switching between non-encrypted and encrypted communications, or are not sufficiently long and random, or are not changed periodically Gary can take over a user's session because there is a long or no inactivity timeout, or a long or no overall session time limit, or the same session can be used from more than one device/location can utilize Adam's session after he has finished, because there is no log out function, or he cannot easily log out, or log out does not properly terminate the session Session Management 8 Session Management 9 Session Management 10 Session Management J Matt can abuse long sessions because the application does not require periodic re-authentication to check if privileges have changed Ivan can steal session identifiers because they are sent over insecure channels, or are logged, or are revealed in error messages, or are included in URLs, or are accessible un-necessarily by code which the attacker can influence or alter Marce can forge requests because per-session, or per-request for more critical actions, strong random tokens or similar are not being used for actions that change state Jeff can resend an identical repeat interaction (e.g. HTTP request, signal, button and it is accepted, not rejected
20140321154944%21OWASP-Cornucopia-Ecommerce_Website.docx