STIGQter: STIG Summary: Web Server Security Requirements Guide Version: 4 Release: 5 Benchmark Date: 01 Jul 2026:

The web server must set an absolute session timeout value of eight hours or less.

DISA Rule

SV-206414r1043182_rule

Vulnerability Number

V-206414

Group Title

SRG-APP-000295

Rule Version

SRG-APP-000295-WSR-000012

Severity

CAT II

CCI(s)

CCI-002361 - Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.

Weight

Fix Recommendation

Configure the web server to close sessions after eight hours or less.

Check Contents

Verify that the web server is configured to close sessions after eight hours or less.

If the web server is not configured to close sessions after eight hours or less, this is a finding.

Vulnerability Number

V-206414

Documentable

False

Rule Version

SRG-APP-000295-WSR-000012

Severity Override Guidance

Verify that the web server is configured to close sessions after eight hours or less.

If the web server is not configured to close sessions after eight hours or less, this is a finding.

Check Content Reference

Target Key

2910