Session Lifetime and Idle Timeout Enforcement
Description
Enforce absolute session lifetime limits and idle inactivity timeouts on all authenticated sessions to minimize the window during which a stolen or abandoned session token can be reused. The control requires: (1) an absolute maximum session duration (e.g., 8-12 hours) after which the session is invalidated regardless of activity, forcing re-authentication; (2) an idle timeout (e.g., 15-30 minutes) that invalidates sessions after a period of no activity; (3) server-side session invalidation on explicit logout that destroys the session record rather than merely clearing the client cookie; and (4) session invalidation on security-relevant account changes (password change, privilege escalation, MFA enrollment) to prevent continued use of pre-change session tokens. Configuration is enforced via application server session-timeout directives (web.xml, Tomcat session-config, Django SESSION_COOKIE_AGE, Rails session_store expire_after), reverse proxy session modules (mod_session MaxAge), or identity provider token lifetime policies (Keycloak/RHSSO access token lifespan, SSO session idle/max settings).
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | An attacker who obtains a session token via XSS, network sniffing, physical access, or session fixation must use it within the idle timeout window before it is automatically invalidated; the compressed exploitation window requires the attacker to have real-time access and act immediately rather than using a token discovered hours or days later |
| Privileges Required (PR) | N → L | Abandoned sessions from previously authenticated users cannot be reused by unauthenticated attackers because idle timeout and absolute lifetime expiration destroy the session state server-side; the attacker must independently authenticate rather than inheriting a stale authenticated session |
CWE Relationships
Verification
Verify that authenticated sessions have both absolute lifetime limits and idle timeouts configured, and that logout explicitly invalidates the server-side session
# Expected: session-timeout set to 30 or less (minutes)
# Expected: SESSION_COOKIE_AGE set to 1800 or less (seconds); SESSION_EXPIRE_AT_BROWSER_CLOSE = True
# Expected: Session expiration configured (e.g., expire_after: 30.minutes)
# Expected: Server-side session invalidation present in logout handler
# Expected: InactivityTimeoutSecs set to 900 or less (15 minutes)