Session management

This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.

• Apply continuous authentication policies to mobile sessions
  Reduce the risk of session hijacking by applying continuous authentication policies to mobile sessions.
• Minimize absolute session timeout duration
  Use the glide.ui.user_cookie.max_life_span_in_days property to set a maximum life span for user cookies created when users log in with the Remember Me checkbox selected. When the cookie expires, users who have selected the Remember Me checkbox are forced to reauthenticate into the instance.
• Define active session timeout exception roles
  Use a system property to exempt roles from active session timeout limits.
• Enable UserCookie version 3.1
  Manage the version of UserCookie that is enabled on your instance to secure the storage of the secret key in the source code.
• Enforce password reset on api requests
  Manage how the password reset functionality operates on your instance.
• Enable HTTP Only Cookie Flag
  Use the glide.cookies.http_only property to enable the HTTPOnly attribute for sensitive cookies.
• Invalidate Session After OAuth Token Expiration [New in Security Center 2.0]
  Use a system property to the secure value to prevent users from continuing to use a session via cookies after the OAuth token used to create the session expires.
• Minimize concurrent interactive session quantity [Updated in Security Center 1.3]
  Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user.
• Limit concurrent sessions across all nodes
  Use the glide.authenticate.limit.concurrent.sessions.across.all.nodes property with the Limit Concurrent Sessions plugin to manage the number of sessions tracked across all nodes.
• Activate Limit Concurrent Sessions Plugin
  Configure the com.glide.limit.concurrent.sessions plugin to reduce the chance of session hijacking on your instance.
• Limit guest's active session life span
  Use the glide.guest.active.session.life_span property to control the duration of an active guest's HTTP sessions.
• Minimize Concurrent Interactive Sessions with Limit Concurrent Sessions Plugin
  Manage the number of interactive sessions on your instance.
• Limit integrations' active session life span
  The glide.integrations.active.session.life_span property enforces max lifespan on active guest HTTP sessions irrespective of inactive timeout. The configured value is in minutes. A value of zero will disable timing out the active sessions.
• Limit policy based session access mobile refresh token interval
  Use the glide.authenticate.session_access.mobile.refresh_token_interval property to govern the length of time that must elapse before a mobile device user will be forced to re-authenticate.
• Limit UI active session life span
  The glide.ui.active.session.life_span property enforces max lifespan on active authenticated HTTP sessions irrespective of inactive timeout.
• Limit session length for high assurance sessions
  Reduce the risk of account takeover in high assurance sessions by limiting session length
• Proactively Invalidate Sessions After Defined Durations
  The glide.active.session.timeout.invalidate.session property controls whether a timeout session is proactively invalidated before the Tomcat server.
• Rotate HTTP session identifiers
  Use the glide.ui.rotate_sessions property to enable rotation of the HTTP session identifiers to reduce security vulnerabilities.
• Minimize concurrent interactive session quantity [Updated in Security Center 1.3]
  Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user.
• Minimize session activity timeout duration
  Use the glide.ui.session_timeout property to designate, in minutes, activity timeout value.
• Minimize session window timeout duration
  Use the glide.ui.user_cookie.life_span_in_days property to set the expiration time period for the Remember Me cookie. The default value is 15 days and the maximum cap is at 30 days.

Parent Topic:Hardening settings