Application Security and Development Security Technical Implementation Guide

The Application Security and Development Security Technical Implementation Guide (V6 R5) has 286 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

286STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V6 · R5

CurrentPublished Wed Sep 30 2026

Applications must validate session identifiers.

Application Security and Development Security Technical Implementation Guide

Assessment Title

Rule Text

Applications must validate session identifiers.

Description

Discussion Text

Many web development frameworks such as PHP, .NET, and ASP include their own mechanisms for session management. Whenever possible it is recommended to utilize the provided session management framework.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-222580

Rule

SV-222580r1043180_rule

Severity

medium

Rule Version

APSC-DV-002260

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the application documentation and interview the application administrator.

Identify how the application validates session IDs.

If using a web development framework, ask the application administrator to provide details on the framework's session configuration as it relates to session validation.

If the application is not configured to validate user session identifiers, this is a finding.

Implementation Procedure

Fix Text

Configure the application to configure user session identifiers.

STIG check 192 of 286 in the Application Security and Development STIG checklist

← Previous · V-222579Applications must use system-generated session identifiers that protect against session fixation.Next · V-222581 →Applications must not use URL embedded session IDs.