CME-807

Session Lifetime and Idle Timeout Enforcement

Description

Enforce absolute session lifetime limits and idle inactivity timeouts on all authenticated sessions to minimize the window during which a stolen or abandoned session token can be reused. The control requires: (1) an absolute maximum session duration (e.g., 8-12 hours) after which the session is invalidated regardless of activity, forcing re-authentication; (2) an idle timeout (e.g., 15-30 minutes) that invalidates sessions after a period of no activity; (3) server-side session invalidation on explicit logout that destroys the session record rather than merely clearing the client cookie; and (4) session invalidation on security-relevant account changes (password change, privilege escalation, MFA enrollment) to prevent continued use of pre-change session tokens. Configuration is enforced via application server session-timeout directives (web.xml, Tomcat session-config, Django SESSION_COOKIE_AGE, Rails session_store expire_after), reverse proxy session modules (mod_session MaxAge), or identity provider token lifetime policies (Keycloak/RHSSO access token lifespan, SSO session idle/max settings).

CVSS Vector Impacts

Metric Transition Rationale
Attack Complexity (AC) L H An attacker who obtains a session token via XSS, network sniffing, physical access, or session fixation must use it within the idle timeout window before it is automatically invalidated; the compressed exploitation window requires the attacker to have real-time access and act immediately rather than using a token discovered hours or days later
Privileges Required (PR) N L Abandoned sessions from previously authenticated users cannot be reused by unauthenticated attackers because idle timeout and absolute lifetime expiration destroy the session state server-side; the attacker must independently authenticate rather than inheriting a stale authenticated session

CWE Relationships

Verification

Verify that authenticated sessions have both absolute lifetime limits and idle timeouts configured, and that logout explicitly invalidates the server-side session

$ grep -rn 'session-timeout\|<session-config>' <app_source>/WEB-INF/web.xml
# Expected: session-timeout set to 30 or less (minutes)
Platform: any
$ grep -rn 'SESSION_COOKIE_AGE\|SESSION_EXPIRE_AT_BROWSER_CLOSE\|SESSION_IDLE_TIMEOUT' <app_source>/settings.py
# Expected: SESSION_COOKIE_AGE set to 1800 or less (seconds); SESSION_EXPIRE_AT_BROWSER_CLOSE = True
Platform: any
$ grep -rn 'expire_after\|session_length\|timeout.*session' <app_source>/config/
# Expected: Session expiration configured (e.g., expire_after: 30.minutes)
Platform: any
$ grep -rn 'session.invalidate\|request.session.flush\|session.destroy\|Session.Abandon' <app_source>/
# Expected: Server-side session invalidation present in logout handler
Platform: any
$ Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Policies\System' -Name InactivityTimeoutSecs -ErrorAction SilentlyContinue | Select-Object InactivityTimeoutSecs
# Expected: InactivityTimeoutSecs set to 900 or less (15 minutes)
Platform: windows
← CME-806: Kerberos Authentication (GSSAPI) CME-901: SSH Hardening (Comprehensive) →