8.2.2 - "with the exception of session tokens" is a bit too wide

[elarlang]

Link to bleeding edge: 8.2.2

"spin-off" requirement from The Monster Issue #843 (comment)

Current (bleeding edge) solution

8.2.2 Verify that data stored in browser storage (such as localStorage, sessionStorage, IndexedDB, or cookies) does not contain sensitive data, with the exception of session tokens.

v4.0.2-8.2.2

Verify that data stored in browser storage (such as HTML5 local storage, session storage, IndexedDB, or cookies) does not contain sensitive data or PII.

v4.0.2-3.2.3 (deleted from bleeding edge):

Verify the application only stores session tokens in the browser using secure methods such as appropriately secured cookies (see section 3.4) or HTML 5 session storage.

For cookie-based sessions there is now separate requirement 3.4.6 in bleeding edge:

3.4.6 Verify that cookie-based session tokens are only transferred in Set-Cookie and Cookie headers.

Change made for for v4.0.3 (just drop the exception, because for v4.0.3 3.2.3 stays and there is no 3.4.6):

8.2.2 Verify that data stored in browser storage (such as localStorage, sessionStorage, IndexedDB, or cookies) does not contain sensitive data.

Problem - a bit too wide open exception

Session token IS sensitive piece of information AND it is stored in some browser storage and therefore anyway in conflict with 8.2.2 (without added exception):

• cookies for cookie-based sessions
• sessionStorage for token-based sessions

With wide-open exception with the exception of session tokens it is allowed to store any type of token in any browser storage.

Solution 1) Should we be more precise with this exception? like (wording needs improvement):

, with the exception of cookie-based session tokens in cookies and token-based session tokens in sessionStorage.

Solution 2) Should we add extra requirement to V3.5.* which says something like:

Verify the application only stores token-based session tokens in the browser sessionStorage

Then previous 3.2.3 is covered with new 3.4.6 and new 3.5.*

ping @jsulinski

[jmanico]

I suggest solution one.

[elarlang]

Options:

... , with the exception of cookie-based session tokens in cookies and token-based session tokens in sessionStorage.

... , with the exception of session tokens (cookie-based session tokens in cookies and token-based session tokens in sessionStorage).

[jmanico]

This one is preferred.

... , with the exception of cookie-based session tokens in cookies and token-based session tokens in sessionStorage.