Spring Boot Misconfiguration: Overly long session timeout
Invicti detected that the web application is configured to use an overly long session timeout.
The server.servlet.session.timeout configuration item from the Spring properties file defines the default session timeout interval for all sessions created in this web application.
The current configuration specified a session timeout value greater than 30 minutes.
Session timeouts greater than 30 minutes are not recommended as they provide attackers more time to complete attacks and exploits. Specifically, overly long sessions make applications more susceptible to session hijacking and cross-user web attacks, such as Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS).
Decrease the value for server.servlet.session.timeout in the Spring properties file like in this example:
server.servlet.session.timeout=30
Select Category
Search Vulnerability
Related Vulnerabilities
