Session Timeout

Check List

Methodology

Black Box

Reusing Session IDs

1

Navigate to https://example.com/ and log into the AWS Management Console using AWS SSO

2

Keep the session idle until the configured session-timeout period is reached and you are automatically logged out of the AWS Management Console

3

After timeout, directly visit the AWS Access Portal URL (https://example.com/awsapps/portal) without performing any new authentication

4

Observe that the portal still grants access and allows re-login into AWS services without requiring a fresh SSO authentication, indicating improper session invalidation

---

Insufficient Session Expiration

1

Open Browser A (Brave) and Browser B (Firefox)

2

Log into the same user account on both browsers using valid credentials

3

In Browser A, navigate to Account Settings → Change Password

4

Update the password to a new value and confirm the successful password change

5

Switch to Browser B and refresh any authenticated page

6

Observe that the session remains active and no re-authentication is required

---

Password Change

1

Observe session timeout behavior and identify client-side session-clear requests (/clearSession)

2

Intercept outgoing requests with a proxy (Burp) and confirm /clearSession is sent periodically

3

Create a match-and-replace rule in the proxy to block/modify /clearSession so it no longer clears the session

4

Verify the session remains active and automated tests can run uninterrupted

5

Inspect logout flow; identify all endpoints called (/clearSession, /authservice/logout)

6

Confirm whether logout actually invalidates server-side sessions

---

White Box

Cheat Sheet