OWASPASVS 5.0 requirement
ASVS-V7.1.1 The user's session inactivity timeout and absolute maximum session lifetime are documented, are appropriate in combination with other…
- Standard
- OWASP ASVS 5.0
- Chapter
- V7 Session Management
- Section
- V7.1 Session Management Documentation
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that the user's session inactivity timeout and absolute maximum session lifetime are documented, are appropriate in combination with other controls, and that the documentation includes justification for any deviations from NIST SP 800-63B re-authentication requirements.