The application must automatically terminate the non-privileged user session and log off non-privileged users after a 15 minute idle time period has elapsed.

From Application Security and Development Security Technical Implementation Guide

Associated with: CCI-002361

SV-83865r1_rule The application must automatically terminate the non-privileged user session and log off non-privileged users after a 15 minute idle time period has elapsed.

Vulnerability discussion

Leaving a user’s application session established for an indefinite period of time increases the risk of session hijacking.Session termination terminates an individual user's logical application session after 15 minutes of application inactivity at which time the user must re-authenticate and a new session must be established if the user desires to continue work in the application.

Check content

Ask the application representative to demonstrate the configuration setting where the idle time out value is defined. Alternatively, logon with a regular application user account and let the session sit idle for 15 minutes. Attempt to access the application after 15 minutes of inactivity. If the configuration setting is not set to time out user sessions after 15 minutes of inactivity, or if the regular user session used for testing does not time out after 15 minutes of inactivity, this is a finding.

Fix text

Design and configure the application to terminate the non-privileged users session after 15 minutes of inactivity.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.