Access Control: Improper Session Invalidation¶

Identifier: improper_session_invalidation

Scanner(s) Support¶

Description¶

Improper session invalidation occurs when sessions, tokens, or authentication state remain usable after logout, credential changes, privilege changes, or other events that should revoke them.

How we test: We replay previously valid session tokens after logout, password reset, privilege change, account disablement, or explicit token revocation events and verify whether protected resources still accept the old authentication state.

References:

• https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html
• https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/06-Testing_for_Logout_Functionality

Configuration¶

Example¶

Example configuration:

---
security_tests:
  improper_session_invalidation:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.