Session id should not be used

A session id should not be used in application logs or as an identifier (in a cache, blacklist, &etc.) because its use could leave user sessions vulnerable to theft if the application is compromised in some other way.

Noncompliant Code Example

public void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException  {
  HttpSession session = request.getSession(false);
  String sessionId = session.getId();  // Noncompliant

  // ...
}

See

• OWASP Top 10 2017 Category A2 - Broken Authentication