Baseline · Auth & access control
B-03 Session tokens are secure
highmanual review
Why it matters
Tokens are unpredictable, expire, and are invalidated on logout.
How to test
Inspect token entropy, expiry, and logout invalidation.
How to fix
Use secure random tokens with expiry and active revocation.