Codereview-Session-Management - Revision history

Thomas Herlea: Added na

2010-09-09T15:56:24Z

Added na

KirstenS: /* Description */

2009-01-16T13:56:56Z

‎Description

KirstenS: /* Description */

2009-01-16T13:56:43Z

‎Description

KirstenS: /* Description */

2009-01-16T13:56:16Z

‎Description

KirstenS: /* Related Security Activities */

2009-01-12T13:45:46Z

‎Related Security Activities

KirstenS: /* Related Vulnerabilities */

2009-01-12T13:42:01Z

‎Related Vulnerabilities

KirstenS: /* Description */

2009-01-12T13:34:23Z

‎Description

KirstenS: /* Description */

2009-01-12T13:33:54Z

‎Description

KirstenS: /* Description */

2009-01-12T13:33:32Z

‎Description

KirstenS: /* Description */

2009-01-12T13:32:35Z

‎Description

@@ Line 1: / Line 1: @@
-==Introduction==
+{{LinkBar
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+  | useprev=PrevLink | prev=Codereview-Authorization | lblprev=Authorization
-[[Category:OWASP Code Review Project]]
+  | usemain=MainLink | main=OWASP Code Review Guide Table of Contents | lblmain=Table of Contents
 ==Description==
@@ Line 67: / Line 70: @@
 See the [[:Category:OWASP Testing Project|OWASP Testing Guide]] article on how to [[Testing for Session Management|Test for Session Management]] Vulnerabilities.

@@ Line 15: / Line 15: @@
 *Sessions may need to be terminated upon authorization failures. If a logical condition exists which is not possible, unless the state transition is circumvented or an obvious attempt to escalate privileges, a session should be terminated.
-'''Session Transport'''
+'''Session Transport'''<br>
 Applications avoid or prevent common web attacks, such as replay, request forging, and man-in-the-middle.
 *Session identifiers should be passed to the user in a secure manner such as not using HTTP GET with the session ID being placed in the query string. Such data (query string) is logged in web server logs.

@@ Line 6: / Line 6: @@
 Session management from a code review perspective should focus on the creation, renewal, and destruction of a user’s session throughout the application. The code review process should ensure the following:
-'''Session ID'''
+'''Session ID'''<br>
 Authenticated users should have a robust and cryptographically secure association with their session. The session identifier (Session ID) should not be predictable, and generation of such should be left to the underlying framework. The development effort to produce a session with sufficient entropy is subject to errors, and best left to tried and trusted methods.

@@ Line 6: / Line 6: @@
 Session management from a code review perspective should focus on the creation, renewal, and destruction of a user’s session throughout the application. The code review process should ensure the following:
-'''Session ID:'''
+'''Session ID'''
 Authenticated users should have a robust and cryptographically secure association with their session. The session identifier (Session ID) should not be predictable, and generation of such should be left to the underlying framework. The development effort to produce a session with sufficient entropy is subject to errors, and best left to tried and trusted methods.
-'''Authorization:'''
+'''Authorization'''
 *Applications should check if the session is valid prior to servicing any user requests. The user's session object may also hold authorization data.
 *Session ID should be applied to a new user upon successful authentication.
 *Reviewing the code to identify where sessions are created and invalidated is important.  A user should be assigned a new unique session once authenticated to mitigate session fixation attacks.
 *Sessions may need to be terminated upon authorization failures. If a logical condition exists which is not possible, unless the state transition is circumvented or an obvious attempt to escalate privileges, a session should be terminated.
 '''Session Transport'''
 Applications avoid or prevent common web attacks, such as replay, request forging, and man-in-the-middle.
 *Session identifiers should be passed to the user in a secure manner such as not using HTTP GET with the session ID being placed in the query string. Such data (query string) is logged in web server logs.
 *Cookie transport should be performed over a secure channel. Review the code in relation to cookie manipulation. Verify if the secure flag is set. This prevents the cookie being transported over a non-secure channel.
+'''Session Lifecycle'''
 *Session Timeout - Sessions should have a defined inactivity timeout and also in some cases a session hard-limit. The code review should examine such session settings. They may be defined in configuration files or in the code itself. Hard limits shall kill a session regardless of session activity.
 *The log-out commands must do more that simply kill the browser. Review the code to verify that log-out commands invalidate the session on the server.  Upon the logout request, be it a parameter or URL, one must review the code to ensure the session is invalidated.
-'''Example for session invalidate:'''
+'''Example for Session Invalidate:'''
   import java.io.*;
   import javax.servlet.*;
@@ Line 49: / Line 44: @@
 ===Related Vulnerabilities===
 *[[Reviewing Code for Data Validation]]
 *[[Reviewing code for XSS issues]]
@@ Line 55: / Line 49: @@
 *[[Reviewing Code for Authentication]]
 *[[Reviewing Code for Session Integrity issues]]
 ==Related Security Activities==

@@ Line 61: / Line 61: @@
 ===Description of Session Management Vulnerabilities===
-See the OWASP article on [[Category:Session_Management_Vulnerability|Session Management Vulnerabilities]].
+See the OWASP articles on [[:Category:Session Management Vulnerability|Session Management Vulnerabilities]].
-===How to Avoid Session Management  Vulnerabilities===
+===Description of Session Management Countermeasures===
-See the [[:Category:OWASP Guide Project|OWASP Development Guide]] article on [[Session_Management Vulnerabilities]].
+See the OWASP articles on [[:Category:Session Management|Session Management Countermeasures]].
-===How to Test for Session Management  Vulnerabilities===
+===How to Avoid Session Management Vulnerabilities===
-See the [[:Category:OWASP Testing Project|OWASP Testing Guide]] article on how to [[Testing_for_Session_Management_Schema|Test for Session Management]] Vulnerabilities.
+See the [[:Category:OWASP Guide Project|OWASP Development Guide]] article on how to [[Session Management|Avoid Session Management]] Vulnerabilities.

← Older revision		Revision as of 13:42, 12 January 2009
Line 55:		Line 55:
	*[[Reviewing Code for Authentication]]		*[[Reviewing Code for Authentication]]
	*[[Reviewing Code for Session Integrity issues]]		*[[Reviewing Code for Session Integrity issues]]
		+
		+
		+	==Related Security Activities==
		+
		+	===Description of Session Management Vulnerabilities===
		+
		+	See the OWASP article on [[Category:Session_Management_Vulnerability\|Session Management Vulnerabilities]].
		+
		+	===How to Avoid Session Management Vulnerabilities===
		+
		+	See the [[:Category:OWASP Guide Project\|OWASP Development Guide]] article on [[Session_Management Vulnerabilities]].
		+
		+	===How to Test for Session Management Vulnerabilities===
		+
		+	See the [[:Category:OWASP Testing Project\|OWASP Testing Guide]] article on how to [[Testing_for_Session_Management_Schema\|Test for Session Management]] Vulnerabilities.

@@ Line 34: / Line 34: @@
   import javax.servlet.http.*;
   import java.sql.*;
-  public class <font color="red>doLogout</font> extends HttpServlet
+  public class <font color="red">doLogout</font> extends HttpServlet
+      {
            public void doGet(HttpServletRequest req,HttpServletResponse res)throws ServletException,IOException

@@ Line 42: / Line 42: @@
                 ses.removeValue("Login");
                 ses.removeValue("password");
                 ses.invalidate();
                 res.sendRedirect("http://company.com/servlets/login.html");
+           }