STIGQter: STIG Summary: IBM WebSphere Liberty Server Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Apr 2026:

HTTP session timeout must be configured.

DISA Rule

SV-250340r1043182_rule

Vulnerability Number

V-250340

Group Title

SRG-APP-000295-AS-000263

Rule Version

IBMW-LS-000720

Severity

CAT II

CCI(s)

• CCI-004895 - Permit users to invoke the trusted communications path for communications between the user and the organization-defined security functions, including at a minimum, authentication and re-authentication.
• CCI-002361 - Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.

Weight

10

Fix Recommendation

The ${server.config.dir}/server.xml file must be configured to update the invalidationTimeout attribute on the httpSession element to set the session timeout value in hours (h) or minutes (m). The server.xml file must define the following:

<httpSession invalidationTimeout="10m"/>

By default, httpSession invalidationTimeout is set to 30m.

Check Contents

As a user with access to the server xml file, review the contents and verify the httpSession time out setting is configured for 10 minutes.

If the ${server.config.dir}/server.xml does not define the timeout setting as 10 minutes, this is a finding.

<httpSession invalidationTimeout="10m"/>

Vulnerability Number

V-250340

Documentable

False

Rule Version

IBMW-LS-000720

Severity Override Guidance

As a user with access to the server xml file, review the contents and verify the httpSession time out setting is configured for 10 minutes.

If the ${server.config.dir}/server.xml does not define the timeout setting as 10 minutes, this is a finding.

<httpSession invalidationTimeout="10m"/>

Check Content Reference

M

Target Key

5424