STIGQter STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must destroy the session ID value and/or cookie on logoff or browser close.

DISA Rule

SV-222578r508029_rule

Vulnerability Number

V-222578

Group Title

SRG-APP-000220

Rule Version

APSC-DV-002240

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure the application to destroy session ID cookies once the application session has terminated.

Check Contents

Review the application documentation and interview the application administrator.

Identify how the application destroys session IDs.

If using a web development framework, ask the application administrator to provide details on the framework's session configuration.

Review framework configuration setting to determine how the session identifiers are destroyed.

Review the client system and using a browser or other tool capable of viewing client cookies, identify cookies set by the application and verify that application session ID cookies are destroyed once the user has logged off or the browser has closed.

If the session IDs and associated cookies are not destroyed on logoff or browser close, this is a finding.

Vulnerability Number

V-222578

Documentable

False

Rule Version

APSC-DV-002240

Severity Override Guidance

Review the application documentation and interview the application administrator.

Identify how the application destroys session IDs.

If using a web development framework, ask the application administrator to provide details on the framework's session configuration.

Review framework configuration setting to determine how the session identifiers are destroyed.

Review the client system and using a browser or other tool capable of viewing client cookies, identify cookies set by the application and verify that application session ID cookies are destroyed once the user has logged off or the browser has closed.

If the session IDs and associated cookies are not destroyed on logoff or browser close, this is a finding.

Check Content Reference

M

Target Key

4093

Comments