CME-807

Session Lifetime and Idle Timeout Enforcement

Harden Identity Unquantified evidence Preventive

Description

Enforce absolute session lifetime limits and idle inactivity timeouts on all authenticated sessions to minimize the window during which a stolen or abandoned session token can be reused. The control requires: (1) an absolute maximum session duration (e.g., 8-12 hours) after which the session is invalidated regardless of activity, forcing re-authentication; (2) an idle timeout (e.g., 15-30 minutes) that invalidates sessions after a period of no activity; (3) server-side session invalidation on explicit logout that destroys the session record rather than merely clearing the client cookie; and (4) session invalidation on security-relevant account changes (password change, privilege escalation, MFA enrollment) to prevent continued use of pre-change session tokens. Configuration is enforced via application server session-timeout directives (web.xml, Tomcat session-config, Django SESSION_COOKIE_AGE, Rails session_store expire_after), reverse proxy session modules (mod_session MaxAge), or identity provider token lifetime policies (Keycloak/RHSSO access token lifespan, SSO session idle/max settings).

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Session tokens discovered post-hoc (in server logs, backup files, breach data, or browser history) are likely already expired due to absolute lifetime and idle timeout limits — the attacker cannot use stale tokens at leisure. For real-time token theft (XSS exfiltration, MITM), the compressed validity window forces the attacker to maintain persistent real-time access and automated replay infrastructure rather than casually replaying a token hours later. However, automated exploitation can complete within milliseconds of real-time token capture, so the protection is strongest against delayed or historical token reuse and weakest against automated real-time session hijacking

CWE Relationships

CWE-613 CWE-384 CWE-539

Verification

Verify that authenticated sessions have both absolute lifetime limits and idle timeouts configured, and that logout explicitly invalidates the server-side session

$ grep -rn 'session-timeout\|<session-config>' <app_source>/WEB-INF/web.xml
# Expected: session-timeout set to 30 or less (minutes)

Platform: any

$ grep -rn 'SESSION_COOKIE_AGE\|SESSION_EXPIRE_AT_BROWSER_CLOSE\|SESSION_IDLE_TIMEOUT' <app_source>/settings.py
# Expected: SESSION_COOKIE_AGE set to 1800 or less (seconds); SESSION_EXPIRE_AT_BROWSER_CLOSE = True

Platform: any

$ grep -rn 'expire_after\|session_length\|timeout.*session' <app_source>/config/
# Expected: Session expiration configured (e.g., expire_after: 30.minutes)

Platform: any

$ grep -rn 'session.invalidate\|request.session.flush\|session.destroy\|Session.Abandon' <app_source>/
# Expected: Server-side session invalidation present in logout handler

Platform: any

$ Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Policies\System' -Name InactivityTimeoutSecs -ErrorAction SilentlyContinue | Select-Object InactivityTimeoutSecs
# Expected: <=900

Platform: windows

Remediation

linux SSH and shell idle session timeout via sshd drop-in and TMOUT


printf 'ClientAliveInterval 300
ClientAliveCountMax 3
' > /etc/ssh/sshd_config.d/99-cme-807-session-timeout.conf
printf 'readonly TMOUT=900\nexport TMOUT\n' > /etc/profile.d/cme-807-timeout.sh && chmod 644 /etc/profile.d/cme-807-timeout.sh
systemctl reload sshd

windows Windows interactive session inactivity timeout via registry policy


Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Policies\System' -Name InactivityTimeoutSecs -Value 900 -Type DWord