Hands-On Security in DevOps

Session management

The CTO also pointed out some existing challenges to the session management implementation. The existing session management needs to tie with specific container technology and does not support various kinds of client application access, such as standalone or non-web application. The CTO would like to have the session management support heterogeneous client access, and wants it to be container-independent. In addition, the team wants to implement the CSRF token in different ways, and this could result in potential risks and extra effort. The CTO expects the team to provide a common library to have consistent CSRF protection.

After assessing the challenges and needs of session management, the security team works on the evaluation ...