SVIG/python-bootcamp
7
0
Fork 1
Code Issues Pull Requests 1 Releases Wiki Activity

Update page 'OWASP test - Sloetjes'

xuanyi.wang
2023-05-25 17:23:35 +02:00
parent f7f0137204
commit bb5ab8a11a
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
OWASP test - Sloetjes.md
+6 -6
@@ -22,12 +22,12 @@
* Describe the logic the web server should use when being presented with a session authorization token from a user, which isn't in the server's corresponding database.
> When the server receives a session authorization token, it should first look up the token in its session database. If the token does not exist, the server should consider this as an invalid or expired session.
> On receiving a session token from a client, search for the token in the session database.
> If not found:
> Return an authentication error (typically HTTP 401 Unauthorized).
> Prompt the user to log in again to create a new valid session.
> If the token is found, validate it to ensure it has not expired and is associated with the user’s current session.
> Continue to serve the requested resources if the token is valid and has appropriate privileges.
> * On receiving a session token from a client, search for the token in the session database.
> * If not found:
> * Return an authentication error (typically HTTP 401 Unauthorized).
> * Prompt the user to log in again to create a new valid session.
> * If the token is found, validate it to ensure it has not expired and is associated with the user’s current session.
> * Continue to serve the requested resources if the token is valid and has appropriate privileges.
> The server should also take note of frequent invalid session token attempts, as these could signify a potential security threat such as session hijacking or token guessing attempts.
==A02==