Access Control: Unbound Session Token¶

Identifier: unbound_session_token

Scanner(s) Support¶

Description¶

Session tokens should be bound to the authenticated session context so attackers cannot reuse or transplant tokens across authentication states or users.

How we test: We analyze session token behavior across authentication transitions and request contexts to detect tokens that remain valid when they should be rotated, invalidated, or bound to a specific session state.

References:

• https://owasp.org/www-community/attacks/Session_fixation
• https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

Configuration¶

Example¶

Example configuration:

---
security_tests:
  unbound_session_token:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.