OWASPASVS 5.0 requirement
ASVS-V7.2.3 If reference tokens are used to represent user sessions, they are unique and generated using a cryptographically secure pseudo-random…
- Standard
- OWASP ASVS 5.0
- Chapter
- V7 Session Management
- Section
- V7.2 Fundamental Session Management Security
- Level
- L1 (requirement applies from this verification level up)
Requirement
Verify that if reference tokens are used to represent user sessions, they are unique and generated using a cryptographically secure pseudo-random number generator (CSPRNG) and possess at least 128 bits of entropy.