3

OWASP recommends setting session timeouts to minimal value possible, to minimize the time an attacker has to hijack the session:

Session timeout define action window time for a user thus this window represents, in the same time, the delay in which an attacker can try to steal and use a existing user session...

For this, it's best practices to :

  • Set session timeout to the minimal value possible depending on the context of the application.
  • Avoid "infinite" session timeout.
  • Prefer declarative definition of the session timeout in order to apply global timeout for all application sessions.
  • Trace session creation/destroy in order to analyse creation trend and try to detect anormal session number creation (application profiling phase in a attack).

(Source)

The most popular methods of session hijacking attacks are , packet , and compromise via , but these are all real-time attacks on the current session.

Once hijacked, the attacker will be able to prevent an idle timeout (via activity), and I would consider any successful session hijack a security breach anyway (unless you want to argue how much larger than zero seconds of access an attacker can have before it actually counts as an actual breach).

If the original method of getting the session token can be repeated, this seems to further limit the usefulness of a timeout -- a 5-minute window that can be repeated indefinitely is effectively not limited.

What real-world attack exists (even theoretically) where a session timeout would be an effective mitigation? Is session expiry really just a form of ?

Improve this question
12

1 Answer 1

Reset to default
1

It prevents damage from a very common and low tech attack: device theft.

If my laptop walks away while i'm in the potty, I'd rather the thief have just 5 mins to flee and hide and start hacking than my online access being available to the more savy fence it's pawned to hours, days, or weeks later...

Improve this answer
5
  • But if the session can be refreshed or prevented from timing out, you still lose.
    – multithr3at3d
    Jan 14, 2020 at 22:35
  • @multithr3at3d: true, but regardless, i stand by "I'd rather the thief have just 5 mins". There's a lot more drug addicts looking for a quick buck than covert operatives waiting for just the right moment to strike a specific target.
    – dandavis
    Jan 14, 2020 at 22:38
  • I agree but even better: you probably were done with most websites 5 minutes before having your laptop stolen. So the thief had no opportunity to hack most of your online accounts. In addition, the “screen lock after 5 minutes of inactivity” can also be considered a session timeout. This prevents an idle home or work computer from being misused 5 minutes after you take a break.
    – Darrell Root
    Jan 15, 2020 at 3:18
  • So let's be clear that this about session timeout, and not automatic device locking The important distinction is with a lock, after authenticating you pick up where you left off. Web applications session timeouts, for example, might restore you to the last page you were on, but not exactly what you were doing, not multiple tabs, and any unsaved work you had is lost. If lock screens worked the same way most application session timeouts work, they'd log you out entirely (forcibly closing all applications).
    – gregmac
    Jan 16, 2020 at 15:58
  • To deal with device theft, for the session timeout to be effective it has to be shorter than the minimum time an attacker would take to obtain the session keys. If the device is locked but not encrypted, this might be what: 5 minutes? If the device is encrypted, barring some design flaw or cryptography breakthrough, probably thousands of years. If the device is unlocked at time of theft, it's maybe 1 minute. So in the security-vs-convenience tradeoff, timeouts >1 minute are providing security against only 'slow' attackers while authenticating multiple times a day gets inconvenient quickly.
    – gregmac
    Jan 16, 2020 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .