Spring Boot Misconfiguration: Overly long session timeout - Vulnerability Database

Spring Boot Misconfiguration: Overly long session timeout

Description

This vulnerability occurs when the server.servlet.session.timeout property in Spring Boot's configuration is set to a value exceeding 30 minutes. This configuration parameter controls how long user sessions remain active after the last interaction. The current configuration allows sessions to persist beyond the recommended security threshold, increasing the window of opportunity for session-based attacks.

Remediation

Configure the session timeout to 30 minutes or less by modifying the server.servlet.session.timeout property in your Spring Boot application properties file (application.properties or application.yml).

For application.properties:

server.servlet.session.timeout=30m

For application.yml:

server:
  servlet:
    session:
      timeout: 30m

Note: The timeout value can be specified in minutes (m), seconds (s), hours (h), or days (d). If no unit is specified, seconds are assumed. After making this change, restart your application for the configuration to take effect. Consider implementing even shorter timeouts (15-20 minutes) for applications handling sensitive data or financial transactions.