ASP.NET expired session IDs are not regenerated - Vulnerability Database

ASP.NET expired session IDs are not regenerated

Description

This ASP.NET web application has the regenerateExpiredSessionId property set to false in its sessionState configuration. This setting prevents the application from generating new session identifiers when expired sessions are encountered. Session IDs are cryptographic tokens that uniquely identify a user's authenticated session with the application. Proper session management requires that when a session expires or a user logs out, the associated session ID should be invalidated and a new one issued for any subsequent authentication to prevent session-based attacks.

Remediation

Configure the ASP.NET application to regenerate expired session IDs by setting the regenerateExpiredSessionId property to true in the sessionState element of your web.config file. This ensures that each new session receives a unique identifier that has never been used before.

Update your web.config as follows:

<configuration>
  <system.web>
    <sessionState regenerateExpiredSessionId="true" />
  </system.web>
</configuration>

After making this change, test your application to ensure session management functions correctly. Additionally, implement proper session timeout values and ensure session IDs are invalidated immediately upon user logout.