0

I am working on Audit logs for an ERP project and searching for all kind of events to be logged.

In this project, session, timeouts on inactivity. I was wondering if logout by session-timeout should be logged.

I was referring to OWASP - Which events to be logged and couldn't find a clear answer on whether a session timeout event should be captured in audit logs or any other log.

Is there any clear requirement / guideline for session-timeout events to be logged ?
(Logout by user is added in the logs)

(Also, since the implementation is timeout based and utilizing the TTL property of session_storage, it would require extra resource to implement the logging for session timeout. I am not sure if session-timeout events are worth the extra resources for its implementation. Please share your opinion / suggestion.)

Improve this question
3
  • In your threat model, what are the implications of a change in numbers of timeout events? If there are any, logging may be a good idea
    – Rory Alsop ♦
    Feb 1, 2019 at 5:51
  • There are no implications as of now.
    – Procrastinator
    Feb 1, 2019 at 6:38
  • 1
    A possible reason for logging them: if a session has timed out, then any attempts to continue using it might indicate someone trying to break the system (or that your clients don't realise the session has timed-out!). Any successful use of a timed-out session would indicate major flaws in your server. Whether this is a part of your "threat model" is up to you to decide.
    – TripeHound
    Feb 1, 2019 at 9:40

1 Answer 1

Reset to default
1

Logging is based on the threats you perceive and also what you might find valuable during an actual security incident.

Another slightly different alternative would be to log any attempts to access a session that expired. Thus you're not logging when a session actually expired. Instead you're logging the moment a user or attacker makes a request against a session that already expired. This should be low resource for coding since you already have the session Id and you're already checking if the session is valid or not so just log in your code the moment you determine Its and invalid session.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .