V-222577
Application Security and Development Security Technical Implementation Guide
Title
The application must not expose session IDs.
Description
<VulnDiscussion>Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions. Application communication sessions are protected utilizing transport encryption protocols, such as SSL or TLS. SSL/TLS provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one-way) or mutual (two-way) in nature. Single authentication a...
Fix Text (Documentation Requirement)
Configure the application to protect session IDs from interception or from manipulation.