계: Security Features

소프트웨어 보안은 보안 소프트웨어가 아닙니다. 여기서는 인증, 액세스 제어, 기밀성, 암호화, 권한 관리 등의 항목에 대해 설명합니다.

Cookie Security: Persistent Session Cookie

Java/JSP
PHP

Abstract

지속적인 세션 쿠키(persistent session cookies)로 인해 계정이 손상될 수 있습니다.

Explanation

지속적인 세션 쿠키는 사용자가 브라우저를 끝낸 후에도 유효하며 "Remember Me" 기능의 일부로 흔히 사용됩니다. 결과적으로 지속적인 세션 쿠키를 사용하면 사용자는 브라우저를 끝낸 후에도 명백하게 로그아웃하지 않았다고 가정되며, 응용 프로그램에 대해 사용자가 인증된 상태로 유지될 수 있습니다. 그러면 브라우저를 여는 다음 사람이 마지막 사용자로 자동 로그인됩니다. 응용 프로그램이 공유 시스템으로부터 사용자가 로그온하도록 허용되지 않은 제어된 환경에서 배포된 경우, 공격자가 브라우저를 닫은 후에도 사용자의 계정이 손상될 가능성이 있습니다.

예제 1: 다음 코드는 세션 쿠키가 지속되도록 설정합니다.


server.servlet.session.cookie.persistent=true

References

[1] Standards Mapping - Common Weakness Enumeration CWE ID 539

[2] Standards Mapping - Common Weakness Enumeration Top 25 2019 [4] CWE ID 200

[3] Standards Mapping - Common Weakness Enumeration Top 25 2020 [7] CWE ID 200

[4] Standards Mapping - Common Weakness Enumeration Top 25 2021 [20] CWE ID 200

[5] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001185, CCI-001941, CCI-001942, CCI-002361

[6] Standards Mapping - FIPS200 MP

[7] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[8] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-12 Session Termination (P2), IA-2 Identification and Authentication (Organizational Users) (P1), SC-23 Session Authenticity (P1)

[9] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-12 Session Termination, IA-2 Identification and Authentication (Organizational Users), SC-23 Session Authenticity

[10] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[11] Standards Mapping - OWASP Application Security Verification Standard 4.0 3.2.3 Session Binding Requirements (L1 L2 L3), 8.3.4 Sensitive Private Data (L1 L2 L3)

[12] Standards Mapping - OWASP Mobile 2014 M9 Improper Session Handling

[13] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[14] Standards Mapping - OWASP Top 10 2004 A8 Insecure Storage

[15] Standards Mapping - OWASP Top 10 2007 A8 Insecure Cryptographic Storage

[16] Standards Mapping - OWASP Top 10 2010 A7 Insecure Cryptographic Storage

[17] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[18] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[19] Standards Mapping - OWASP Top 10 2021 A04 Insecure Design

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.3, Requirement 6.5.8

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.3, Requirement 6.5.7, Requirement 6.5.8

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.3

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.3, Requirement 6.5.10

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.3, Requirement 6.5.10

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.3, Requirement 6.5.10

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.3, Requirement 6.5.10

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[28] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[31] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3210.1 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3210.1 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3210.1 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3210.1 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3210.1 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3210.1 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3210.1 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[39] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[53] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authentication (WASC-01)

[54] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authentication

desc.config.java.cookie_security_persistent_session_cookie

Abstract

지속적인 세션 쿠키로 인해 계정이 손상될 수 있습니다.

Explanation

지속적인 세션 쿠키는 사용자가 브라우저를 끝낸 후에도 유효하며 "Remember Me" 기능의 일부로 흔히 사용됩니다. 결과적으로 지속적인 세션 쿠키를 사용하면 사용자는 브라우저를 끝낸 후에도 명백하게 로그아웃하지 않았다고 가정되며, 응용 프로그램에 대해 사용자가 인증된 상태로 유지될 수 있습니다. 그러면 브라우저를 여는 다음 사람이 마지막 사용자로 자동 로그인됩니다. 응용 프로그램이 공유 시스템으로부터 사용자가 로그온하도록 허용되지 않은 제어된 환경에서 배포된 경우, 공격자가 브라우저를 닫은 후에도 사용자의 계정이 손상될 가능성이 있습니다.
예제 1: 다음 코드는 세션 쿠키가 10년 후에 만료되도록 설정합니다.


session_set_cookie_params(time()+60*60*24*365*10, "/", "www.example.com", false, true);

References

[1] session_set_cookie_params The PHP Group

[2] Standards Mapping - Common Weakness Enumeration CWE ID 539

[3] Standards Mapping - Common Weakness Enumeration Top 25 2019 [4] CWE ID 200

[4] Standards Mapping - Common Weakness Enumeration Top 25 2020 [7] CWE ID 200

[5] Standards Mapping - Common Weakness Enumeration Top 25 2021 [20] CWE ID 200

[6] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001185, CCI-001941, CCI-001942, CCI-002361

[7] Standards Mapping - FIPS200 MP

[8] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[9] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-12 Session Termination (P2), IA-2 Identification and Authentication (Organizational Users) (P1), SC-23 Session Authenticity (P1)

[10] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-12 Session Termination, IA-2 Identification and Authentication (Organizational Users), SC-23 Session Authenticity

[11] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[12] Standards Mapping - OWASP Application Security Verification Standard 4.0 3.2.3 Session Binding Requirements (L1 L2 L3), 8.3.4 Sensitive Private Data (L1 L2 L3)

[13] Standards Mapping - OWASP Mobile 2014 M9 Improper Session Handling

[14] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[15] Standards Mapping - OWASP Top 10 2004 A8 Insecure Storage

[16] Standards Mapping - OWASP Top 10 2007 A8 Insecure Cryptographic Storage

[17] Standards Mapping - OWASP Top 10 2010 A7 Insecure Cryptographic Storage

[18] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[19] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[20] Standards Mapping - OWASP Top 10 2021 A04 Insecure Design

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.3, Requirement 6.5.8

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.3, Requirement 6.5.7, Requirement 6.5.8

[23] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.3

[24] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.3, Requirement 6.5.10

[25] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.3, Requirement 6.5.10

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.3, Requirement 6.5.10

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.3, Requirement 6.5.10

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[29] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[30] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[31] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[32] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3210.1 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3210.1 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3210.1 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3210.1 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3210.1 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3210.1 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3210.1 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[40] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[41] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[42] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[43] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[44] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[45] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[46] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[47] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[48] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[49] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[50] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[51] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[52] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[53] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-000060 CAT II, APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002240 CAT I

[54] Standards Mapping - Web Application Security Consortium Version 2.00 Insufficient Authentication (WASC-01)

[55] Standards Mapping - Web Application Security Consortium 24 + 2 Insufficient Authentication

desc.semantic.php.cookie_security_persistent_session_cookie