ASVS 5.0 V7.6.2 (Level 2) requires that creating an application session needs the user's consent or an explicit action. A page load, an image request or a redirect from an IdP must not quietly sign someone in.
Why it matters
Silent session creation enables login CSRF, where an attacker signs the victim into the attacker's account, and it makes shared device mishaps worse. A user should know they have signed in, and to what.
How to implement it
For SSO, if an IdP session exists, still show a clear "Continue as" step on first visit, or require the user to press the sign in button. Treat the callback as completing a flow the user started: store a random state value before the redirect and check it on return.
// start of login
const state = crypto.randomBytes(32).toString("hex");
req.session.oidcState = state;
// callback
if (!req.query.state || req.query.state !== req.session.oidcState) {
return res.status(400).send("Invalid login attempt");
}
delete req.session.oidcState;
Never create sessions on GET requests to public routes just because a header or cookie hints at an identity.
How to test it
Load your app with a valid IdP session in the browser and no prior app session. Confirm you land on a prompt or sign in page, not a logged in dashboard. Replay a callback URL without the original state and confirm rejection.
Common mistakes
- Auto login through silent IdP redirects with no interaction.
- Skipping the state parameter.
- Creating a guest session that carries privileges.
Quick check
Does this forbid SSO convenience?
No. One click after a clear prompt satisfies it. What is forbidden is signing in with no user interaction.
