Insufficient Session Expiration

An authenticated session, especially statefull tokens, must expire after a period of time. Otherwise an adversary has higher chance of reusing an old token and get an unauthorised access.

Remediation

Implement an expiry time for the token. The shorter is the expiry, the lower is the likelihood of token abuse.

Metadata

Severity: low
Slug: insufficient-session-expiration

CWEs

613: Insufficient Session Expiration

OWASP

A07:2021: Identification and Authentication Failures

Available Labs

Select a language to explore available labs for this vulnerability.

1 Lab

Go Labs

Go 1 lab

Explore 1 lab in Go.

1 Lab

Javascript Labs

Javascript 1 lab

Explore 1 lab in Javascript.

1 Lab

Python Labs

Python 1 lab

Explore 1 lab in Python.

1 Lab

Ruby Labs

Ruby 1 lab

Explore 1 lab in Ruby.

No matching labs found

Try adjusting your language filter.

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.