Summary;
The application does not automatically expire authenticated sessions after a prolonged period of inactivity. Once a user successfully logs in, the session remains valid indefinitely unless the user manually logs out or the session is otherwise invalidated.
This creates a prolonged session exposure risk, particularly on shared, lost, or compromised devices.
Steps to Reproduce;
Log in to a valid account.
Capture the authenticated session/cookie.
Remain inactive for an extended period without logging out.
After the expected inactivity period, revisit an authenticated endpoint using the same session.
Observe that the session remains valid and access to the account is still available.
Authenticated sessions should automatically expire after a reasonable period of inactivity and require the user to authenticate again.
The authenticated session remains active for a prolonged/indefinite period without automatic expiration.
Fix;
Implement server-side session expiration with:
A reasonable idle timeout max 2 hours