STIGQter: STIG Summary: Xylok Security Suite 20.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Xylok Security Suite must expire a session upon browser closing.

DISA Rule

SV-269572r1053491_rule

Vulnerability Number

V-269572

Group Title

SRG-APP-000005

Rule Version

XYLK-20-000005

Severity

CAT I

CCI(s)

• CCI-000056 - Retain the device lock until the user reestablishes access using established identification and authentication procedures.
• CCI-001185 - Invalidate session identifiers upon user logout or other session termination.
• CCI-002361 - Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.
• CCI-002891 - Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions.

Weight

10

Fix Recommendation

Set the session expiration:
1. As root, open /etc/xylok.conf in a text editor.

2. Add/Amend "SESSION_EXPIRE_AT_BROWSER_CLOSE=True" to the configuration file.

3. Restart Xylok to apply settings by executing the following:
# systemctl restart xylok

Check Contents

Verify session expires after browser is closed. Execute the following:
$ grep SESSION_EXPIRE_AT_BROWSER_CLOSE /etc/xylok.conf

SESSION_EXPIRE_AT_BROWSER_CLOSE=True

If "SESSION_EXPIRE_AT_BROWSER_CLOSE" is not set to "True" or is missing, this is a finding.

Vulnerability Number

V-269572

Documentable

False

Rule Version

XYLK-20-000005

Severity Override Guidance

Verify session expires after browser is closed. Execute the following:
$ grep SESSION_EXPIRE_AT_BROWSER_CLOSE /etc/xylok.conf

SESSION_EXPIRE_AT_BROWSER_CLOSE=True

If "SESSION_EXPIRE_AT_BROWSER_CLOSE" is not set to "True" or is missing, this is a finding.

Check Content Reference

M

Target Key

5665