service-manual 2 linked patterns checked
OWASP Session Management Cheat Sheet
Documents idle and absolute session timeout guidance, risk-based timeout durations, renewal behavior, and session expiration considerations for authenticated web applications.
Read with a purpose
What this source can teach
Use this source to study a complete public-service task and the guidance that supports its implementation.
- Start with the original. Open the source and find the guidance or example relevant to your task.
- Trace the connection. Use the claim notes below to see how this site applies the source to specific patterns.
- Check the setting. Compare the source's platform, people, and constraints with your own decision.
Pattern Decisions This Source Supports
| Pattern | Supported decision | Required contract | Claim note |
|---|---|---|---|
| Session timeout | Choose session timeout when the authenticated session has already expired or been terminated and the next valid path is sign-in, reauthentication, restart, or safe task restoration. | The timeout state is driven by server or identity-provider session validity, not by a cosmetic client-only overlay. | Supports session expiration, automatic logout after idle timeout, and avoiding silent expiry that loses work. |
| Session timeout warning | Choose session timeout warning when the session is approaching an inactivity, absolute, device-lock, or reauthentication boundary that can interrupt authenticated work. | The warning is driven by the authoritative session or identity state, not only a local countdown. | OWASP documents idle and absolute session timeout guidance. |
Comparisons supported by this source
- Session timeout vs session timeout warning vs sign in vs permission denied state vs autosave recovery
Supports session expiration, automatic client logout after idle timeout, and work-loss concerns around silent expiry.
- Session timeout warning vs exit warning vs autosave form vs permission denied state
OWASP documents idle and absolute session timeouts and risk-based timeout durations.
Evidence Role
This source is treated as service-manual evidence. Its value comes from the specific claims and setting described above.
Publisher: OWASP Foundation. Last checked: .