Add requirement against autologin without user interaction (#1929)

OWASP · Apr 16, 2024 · b807869 · b807869
1 parent 4ef55f6
commit b807869
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/5.0/en/0x12-V3-Session-management.md b/5.0/en/0x12-V3-Session-management.md
@@ -27,6 +27,7 @@ As previously noted, these requirements have been adapted to be a compliant subs
 | **3.2.2** | [MODIFIED] Verify that opaque session tokens possess at least 128 bits of entropy. | ✓ | ✓ | ✓ | 331 | 7.1 |
 | **3.2.3** | [DELETED, MERGED TO 8.2.2] | | | | | |
 | **3.2.4** | [MODIFIED] Verify that opaque session tokens are generated using a secure random function. | | ✓ | ✓ | 330 | 7.1 |
+| **3.2.5** | [ADDED] Verify that creating a session for the application requires the user's consent and that the application is protected against a CSRF-style attack where a new application session for the user is created via SSO without user interaction. | | ✓ | ✓ | | |
 
 TLS or another secure transport channel is mandatory for session management. This is covered in the Communications Security chapter.