SUBMITTED MANUSCRIPT
Lifecycle Conditions in CWE-613 Disclosures: A Reproducible, Evidence-Linked Characterisation
What should stop working after logout, expiration or a change in authority?
The research examines how session-lifecycle conditions are described in vulnerability disclosures and how an explicit follow-up test can distinguish different changes in authority.
My contribution
I developed SessTrace, a controlled HTTP laboratory with event-driven and time-driven lifecycle cases, vulnerable and fixed variants, and replay controls. The research combines this practical testing perspective with evidence-linked analysis of vulnerability records.
How the question is investigated
Define the lifecycle event and expected change, retain the evidence supporting the interpretation, and test the follow-up protected action. Distinguish a recorded result from cached content, an unclear policy or a condition not tested.
- Identify the event. Logout, expiration and permission changes can withdraw different kinds of authority.
- State the expected result. Define which protected action the earlier credential should no longer permit.
- Replay and compare. Use controlled cases and explicit observations to distinguish a failure from an assumption.
Discussing the work
This is a public summary. Source archives and manuscript downloads are not attached here. Contact me to discuss the method or the availability of an approved shareable version.
Discuss the research