SecurityInnovation/TMContentReview — Issue #33: Change Session IDs During Reauthentication
Author: SergeTruth
Created: 2011-11-07 22:17:11+00:00
State: open

Can you clarify what "reauthentication" is. For example, is it providing the old password when changing a password or is it providing additional proof of who you are when conducting operations which are deemed as extra sensitive operations (transfering over 10K to a foreign account).

This may cause head aches for applications which store information presistently in the session are not aware of the requirement to support the possibility of the objects being cleared out my reauthentication.

Also there needs to be discussion of the actual risk given that most applications use SSL and implement 32. above.