STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must destroy the session ID value and/or cookie on logoff or browser close.

DISA Rule

SV-222578r508029_rule

Vulnerability Number

V-222578

Group Title

SRG-APP-000220

Rule Version

APSC-DV-002240

Severity

CAT I

CCI(s)

CCI-001185 - The information system invalidates session identifiers upon user logout or other session termination.

Weight

Fix Recommendation

Configure the application to destroy session ID cookies once the application session has terminated.

Check Contents

Review the application documentation and interview the application administrator.

Identify how the application destroys session IDs.

If using a web development framework, ask the application administrator to provide details on the framework's session configuration.

Review framework configuration setting to determine how the session identifiers are destroyed.

Review the client system and using a browser or other tool capable of viewing client cookies, identify cookies set by the application and verify that application session ID cookies are destroyed once the user has logged off or the browser has closed.

If the session IDs and associated cookies are not destroyed on logoff or browser close, this is a finding.

The application must destroy the session ID value and/or cookie on logoff or browser close.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key

Comments