Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Recreating a session token without explicitly deleting the previous session from the token store can result in insufficient session expiration. Orphaned session identifiers may remain fully privileged, allowing session hijacking. Ensure the old session is deleted (e.g., typically via `$TOKEN.del()`) before generating and assigning a new one.
When rescoping or mapping a new session context from an existing token, the original token's expiration time is not explicitly preserved. Failing to propagate the `expires_at` property can allow an attacker to indefinitely extend session lifetimes by repeatedly rescoping tokens before their explicit expiration.
OIDC configurations do not enforce session invalidation on token expiration. This allows an authenticated session to persist indefinitely. Configure `logoutWhenIdTokenIsExpired(true)` on the `OpenIdConfiguration.Builder`.
This function validates a password-reset / token record by comparing `$RESET.key` for plain equality without verifying the record's age or using a constant-time comparison. Reset tokens that never expire allow account takeover when an attacker obtains a previously issued (unused) reset email — e.g., from a leaked mailbox archive (CWE-613). Enforce an expirat
Logout handler does not regenerate or destroy the PHP session ID. Clearing application-level authentication state without rotating the session identifier leaves the session cookie valid after logout, enabling session hijacking and session-fixation attacks (CWE-613). Add a call to session_regenerate_id(true), session_destroy(), or an equivalent session-ID rot
The configured token revocation action for AshAuthentication lacks a `:boolean` return type or explicitly disallows missing inputs with `allow_nil?: false`. This flawed action configuration fails to process token input gracefully, allowing revoked tokens to evade revocation checks and continue authenticating users. To fix this, specify `:boolean` as the retu
A client-side logout/signout function was found that clears local storage or session storage but does not clear `document.cookie`. If the application relies on cookies for certain features or authentication (such as a separate dashboard token), failing to clear them during logout can allow subsequent users on shared devices to reuse the hijacked session. Ver
A custom session handler implements the `read` method using database queries without checking the session's expiration time. PHP's internal garbage collection (`gc`) is only called probabilistically based on `session.gc_probability` and `session.gc_divisor`. Consequently, expired sessions remain in the data store for an unpredictable amount of time, allowing
'Session middleware settings: `maxAge` not set. Use it to set expiration date for cookies.'
JSCWE-613
