SVIG/python-bootcamp
7
0
Fork 1
Code Issues Pull Requests 1 Releases Wiki Activity

Update page 'OWASP test - Sloetjes'

xuanyi.wang
2023-05-25 17:23:35 +02:00
parent f7f0137204
commit bb5ab8a11a
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
OWASP test - Sloetjes.md
+6 -6
@@ -22,12 +22,12 @@
* Describe the logic the web server should use when being presented with a session authorization token from a user, which isn't in the server's corresponding database. * Describe the logic the web server should use when being presented with a session authorization token from a user, which isn't in the server's corresponding database.
> When the server receives a session authorization token, it should first look up the token in its session database. If the token does not exist, the server should consider this as an invalid or expired session. > When the server receives a session authorization token, it should first look up the token in its session database. If the token does not exist, the server should consider this as an invalid or expired session.
> On receiving a session token from a client, search for the token in the session database. > * On receiving a session token from a client, search for the token in the session database.
> If not found: > * If not found:
> Return an authentication error (typically HTTP 401 Unauthorized). > * Return an authentication error (typically HTTP 401 Unauthorized).
> Prompt the user to log in again to create a new valid session. > * Prompt the user to log in again to create a new valid session.
> If the token is found, validate it to ensure it has not expired and is associated with the user’s current session. > * If the token is found, validate it to ensure it has not expired and is associated with the user’s current session.
> Continue to serve the requested resources if the token is valid and has appropriate privileges. > * Continue to serve the requested resources if the token is valid and has appropriate privileges.
> The server should also take note of frequent invalid session token attempts, as these could signify a potential security threat such as session hijacking or token guessing attempts. > The server should also take note of frequent invalid session token attempts, as these could signify a potential security threat such as session hijacking or token guessing attempts.
==A02== ==A02==