Navigate

Check: SRG-APP-000295-WSR-000012

Web Server SRG: SRG-APP-000295-WSR-000012 (in versions v3 r2 through v2 r2)

Title

The web server must set an absolute timeout for sessions. (Cat II impact)

Discussion

Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after an absolute period of time, the user is forced to re-authenticate guaranteeing the session is still in use. Enabling an absolute timeout for sessions closes sessions that are still active. Examples would be a runaway process accessing the web server or an attacker using a hijacked session to slowly probe the web server.

Check Content

Review the web server documentation and deployed configuration to verify that the web server is configured to close sessions after an absolute period of time. If the web server is not configured to close sessions after an absolute period of time, this is a finding.

Fix Text

Configure the web server to close sessions after an absolute period of time.

Additional Identifiers

Rule ID: SV-206414r879673_rule

Vulnerability ID: V-206414

Group Title: SRG-APP-000295

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-002361	Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AC-12	Session Termination