Fixing insufficient session expiration
In general, web applications create sessions to maintain users' intercommunication with the web server between multiple requests. These sessions bind a user's identity and support authenticated users being tracked. An ASP.NET Core web application must keep the length of an authenticated user's session to a minimum. This helps avoid the risk of causing a wide window of opportunity for a bad actor to take advantage in the event of a session-based attack.
In this recipe, we will shorten the validity of a session to mitigate the risk of session-based attacks.
Getting ready
Using Visual Studio Code, open the sample Online Banking app folder at \Chapter03\improper-session\before\OnlineBankingApp.
How to do it…
Let's take a look at the steps for this recipe:
- Type the following command in the Terminal to build the sample app to confirm there are no compilation errors:
dotnet build
- Open the
\Chapter03...
