OWASP Annotated Application Security Verification Standard
latest
Browse by chapter:
1 Architecture, Design and Threat Modeling
2 Authentication
3 Session Management
3.1 Fundamental Session Management Requirements
3.2 Session Binding Requirements
3.2.1 The application generates a new session token on user authentication
3.2.2 Session tokens possess at least 64 bits of entropy
3.2.3 Session tokens are stored using secure methods
3.2.4 TODO
3.3 Session Logout and Timeout Requirements
3.4 Cookie-based Session Management
3.5 Token-based Session Management
3.6 Re-authentication from a Federation or Assertion
3.7 Defenses Against Session Management Exploits
4 Access Control
5 Validation, Sanitization and Encoding
6 Stored Cryptography
7 Error Handling and Logging
8 Data Protection
9 Communications
10 Malicious Code
11 Business Logic
12 Files and Resources
13 API and Web Service
14 Configuration
OWASP Annotated Application Security Verification Standard
Docs
»
3 Session Management
»
3.2 Session Binding Requirements
3.2 Session Binding Requirements
ΒΆ
Browse by item:
3.2.1 The application generates a new session token on user authentication
3.2.2 Session tokens possess at least 64 bits of entropy
3.2.3 Session tokens are stored using secure methods
3.2.4 TODO