Re: Session security with cookies

[Thomas <tom () electric-sheep org>]

> -Ensure the session times out in a reasonable amount of time

Timeouts have to be enforced by the server because cookie lifetime is not
mandatory and can be ignored or/and modified by the client.

-- 
Tom <tom () electric-sheep org>
fingerprint = F055 43E5 1F3C 4F4F 9182  CD59 DBC6 111A 8516 8DBF

-------------------------------------------------------------------------
Sponsored by: Watchfire 
Methodologies & Tools for Web Application Security Assessment 
With the rapid rise in the number and types of security threats, web application security assessments should be 
considered a crucial phase in the development of any web application. What methodology should be followed? What tools 
can accelerate the assessment process? Download this Whitepaper today! 

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------