V-206398
Web Server Security Requirements Guide
Title
The web server must accept only system-generated session identifiers.
Description
<VulnDiscussion>Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. In order to maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user, if the user previously logged into a hosted application. When a web server accepts session identifiers that are not gener...
Fix Text (Documentation Requirement)
Configure the web server to only accept session IDs that are created by the web server.