OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

The product does not encrypt sensitive or critical information before storage or transmission.

Storing a password in plaintext may result in a system compromise.

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal au...

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top Ten is ...