KB39450: How MicroStrategy Web 9.x and 10.x handles best practices requirements for secure session management.

The following is a list of best practices for secure session management, and how Strategy handles these requirements.

1. Session identifiers must be sufficiently long - short session identifiers can be more quickly and easily brute-forced.
   Strategy relies on the application server or web server management capabilities to ensure the jsessionID/ASP.Net_SessionID entropy and cryptographic strength. The Intelligence Server session information is stored in the HTTP session.
   
    
   
2. Session identifiers should be unpredictable - for example, they should not be sequential.
   As stated for Point 1, Strategy relies on the application server or web management capabilities.
   
    
   
3. Session information should not be stored on the client, as information stored on the client can be easily compromised.
   Strategy does not store any session information on the file system of the client - session information is only stored in the browser as a temporary cookie and is only valid while the browser session is valid. Once the browser is closed, the session information becomes invalid. The Intelligence Server session information gets stored in the HTTP session, which is managed on the application server/web server side; similarly, the client will keep track of its HTTP session with a temporary cookie.
    
   In addition, the option to enable and disable cookies is available in the Security page in the Strategy Web Administrator page. Enabling cookies allows session information to be passed in the HTTP headers, while disabling cookies would only pass the session cookie, and not any Strategy session information.
    
4. Session information stored on the server should be protected - it should only be used by the server site application and should not be accessed by clients.
   As mentioned previously, session information is not stored on the file system of the client machine - instead, everything is maintained in the memory of the Web Server. The only way a client can access the information stored in an HTTP session is via the jsessionID/ASP.Net_SessionID, which is managed by the application server.
   
    
   
5. Session identifiers should have a limited lifetime.
   Session information is only valid for as long as the browser session is open. As mentioned previously, when the browser is closed, the session information becomes invalid. HTTP session are also set to expire after 30 mintues of inactivity per the <session-timeout> parameter in the web.xml file. This is a fairly standard value for application servers and ensures that HTTP sessions do not exprie before the I-Server session information it contains does (Web has a 20 mintues session timeout by default).