BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

APSC-DV-002260 Applications must validate session identifiers.

DISA STIG library V6R5
All changes in this version
first version loaded CAT II

Maps to SC-23(3) via CCI-001664

Title

Applications must validate session identifiers.

Control

Review the application documentation and interview the application administrator. Identify how the application validates session IDs. If using a web development framework, ask the application administrator to provide details on the framework's session configuration as it relates to session validation. If the application is not configured to validate user session identifiers, this is a finding.

Discussion

Many web development frameworks such as PHP, .NET, and ASP include their own mechanisms for session management. Whenever possible it is recommended to utilize the provided session management framework.

Related controls

CCI-001664

Fix

Configure the application to configure user session identifiers.