Insufficient Session Expiration

An authenticated session, especially statefull tokens, must expire after a period of time. Otherwise an adversary has higher chance of reusing an old token and get an unauthorised access.

Remediation

Implement an expiry time for the token. The shorter is the expiry, the lower is the likelihood of token abuse.

Metadata

Severity: low
Slug: insufficient-session-expiration

CWEs

613: Insufficient Session Expiration

OWASP

A07:2021: Identification and Authentication Failures

Available Labs

Open Ruby labs in SecDim Play for this vulnerability.

medium

Bad token.rb

Ruby Medium Sinatra Signature

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.