The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Do not fall into the trap of examining actions that the application per-

forms on the client-side token (such as cookie invalidation via a new

Set-Cookie

instruction, client-side script, or an expiration time

attribute). In terms of session termination, nothing much depends upon

what happens to the token within the client browser. Rather, investigate

whether session expiration is implemented on the server side:

■

Log in to the application to obtain a valid session token.

■

Wait for a period without using this token, and then submit a request

for a protected page (e.g., “my details”) using the token.

■

If the page is displayed as normal, then the token is still active.

■

Use trial and error to determine how long any session expiration time-