357 – Use stateless session tokens

Summary

The system should use securely generated, stateless session tokens that are validated using digital signatures instead of static API secrets.

Description

This approach is aligned with security best practices by emphasizing the use of cryptography for securing session tokens. Digital signatures provide a robust mechanism for ensuring the authenticity and integrity of tokens. Static API secrets, such as hardcoded keys or long-lived secrets, present security risks if compromised. The general recommendation is to avoid using static secrets and instead rely on dynamically generated session tokens secured with digital signatures.

Supported In

Advanced: True

References

• CWE-798. Use of hard-coded credentials
• OWASP10-A7. Identification and authentication failures
• OWASP10-A8. Software and data integrity failures
• OWASPM10-M4. Insecure authentication
• PADSS-3_1_4. Application employs methods to authenticate all users
• IEC62443-SI-3_8. Session integrity
• IEC62443-CR-1_1-RE_1. Unique identification and authentication
• WASSEC-3_3. Session token detection configuration
• WASSEC-6_2_2_1. Authorization - Credential/Session prediction
• OWASPSCP-4. Session management
• SWIFTCSC-5_2. Token management
• ASVS-3_5_2. Token-based session management
• ASVS-3_5_3. Token-based session management
• CASA-3_5_2. Token-based Session Management
• CASA-3_5_3. Token-based Session Management

Weaknesses

• 321 – Lack of data validation - HTML code
• 340 – Lack of data validation - Special Characters
• 341 – Lack of data validation - OTP
• 344 – Lack of data validation - Non Sanitized Variables
• 353 – Lack of data validation - Token

Last updated

2024/01/18