From Web Server Security Requirements Guide
Part of SRG-APP-000220-WSR-000201
Associated with: CCI-001185
Captured sessions can be reused in "replay" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs.
Review the web server documentation and deployed configuration to verify that the web server is configured to invalidate session identifiers when a session is terminated. If the web server does not invalidate session identifiers when a session is terminated, this is a finding.
Configure the web server to invalidate session identifiers when a session is terminated.
Lavender hyperlinks in small type off to the right (of CSS
class id
, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle
or
Accept: application/rdf+xml
.
Powered by sagemincer