8 9 10 J Session Session Session Session Matt can abuse long sessions Ivan can steal session identifiers Marce can forge requests because Jeff can resend an identical because the application does not because they are sent over per-session, or per-request for interaction (e.g. HTTP request, require periodic re-authentication insecure channels, or are logged, more critical actions, strong signal, button press) and it is Management Management Management Management to check if privileges have or are revealed in error messages, random tokens or similar are not accepted, not rejected changed or are included in URLs, or are being used for actions that accessible un-necessarily by code change state which the attacker can influence or alter Q K Session Session Salim can bypass session Peter can bypass the session (no card) (no card) management because it is not management controls because applied comprehensively and they have been self-built and/or Management Management consistently across the are weak, instead of using a application standard framework or approved tested module
Session Management 8 Session Management 9 Session Management 10 Session Management J Matt can abuse long sessions because the application does not require periodic re-authentication to check if privileges have changed Ivan can steal session identifiers because they are sent over insecure channels, or are logged, or are revealed in error messages, or are included in URLs, or are accessible un-necessarily by code which the attacker can influence or alter Marce can forge requests because per-session, or per-request for more critical actions, strong random tokens or similar are not being used for actions that change state Jeff can resend an identical interaction (e.g. HTTP request, signal, button press) and it is accepted, not rejected Session Management Q Session Management K Salim can bypass session management because it is not applied comprehensively and consistently across the application Peter can bypass the session management controls because they have been self-built and/or are weak, instead of using a standard framework or approved tested module (no card) (no card)
20130918180752%21OWASP-Cornucopia-Ecommerce_Website.docx