Session Security Audit

finserv-session-security · v1.1.0 · paid

Evaluates session inactivity timeouts, step-up authentication for sensitive operations, concurrent session controls, session fixation prevention, and device trust.

Session Lifecycle

session-lifecycle · weight 0.3

Sessions expire after 15min inactivity for financial ops
ab-001457
critical
Absolute timeout max 8 hours regardless of activity
ab-001458
high
Logout clears client+server session data within 1s
ab-001459
high
Session resumption after network interrupt requires re-auth
ab-001460
medium
Timeout warning ≥2min before expiration with extend option
ab-001461
medium
Session operations logged immutably
ab-001462
info
Timeout configurable per org, min 15min
ab-001463
info
Session analytics reviewed quarterly
ab-001464
info

Step-Up Authentication

step-up-auth · weight 0.28

Step-up auth for transfers/wires/payments
ab-001465
high
Step-up uses equal or higher strength than initial login
ab-001466
medium
Biometric step-up accepted without secondary OTP for single-device
ab-001467
low
OTP/SMS/email for step-up on multi-device/web
ab-001468
low

Concurrent Session Control

concurrent-control · weight 0.22

Concurrent sessions limited to 1, warning on new login
ab-001469
high
User can view/terminate active sessions remotely
ab-001470
low
Login location tracking (country/city/IP)
ab-001471
low

Session Integrity

session-integrity · weight 0.2

Session fixation prevented: new session ID on login
ab-001472
critical
Session tokens in secure HTTP-only cookies, SameSite=Strict
ab-001473
high
Device fingerprinting on login; new device triggers step-up
ab-001474
medium
Suspicious activity triggers additional step-up
ab-001475
low
Session data not in localStorage; memory-only or secure cookie
ab-001476
low