Tickets :: Comment on [#12136] Session Timeout not enforced

* Your Email Address
* Spam protection	Enter the letters below: .__ . .. . __. . [__)\ /\| \|(__ \| \| \/ \|__\|.__)\__\|
Comment	> You have yet to explain HOW it is a "security issue" when, for > example, a session lasts 35 minutes and the session timeout value is > actually 30 minutes. What about those extra 5 minutes makes it a > "security issue"? > > We don't guarantee a session will automatically timeout at 30 minutes > and 1 second, and why would we? Session timeouts are not (and should > not) be an exact value. Session timeouts are there to prevent a > SINGLE attack vector: someone manages to obtain your session > credentials/ID (the assumption being that this takes time) and can > then use this to access an unexpired session at some point in the > future. Having a session persist 5-10 minutes beyond its timeout > value does not materially affect/change this vector. > > Those links you provided are not helpful. You absolutely do NOT want > to be setting/changing a "timestamp" in your session every page > access. Yikes.
Attachment
Watch this ticket