Australian Information Security Manual ISM-2065: Web application session cookies using opaque bearer tokens that are not digitally signed u

Web application session cookies using opaque bearer tokens that are not digitally signed use non-sequential random identifiers with a minimum of 128 bits of entropy, preferably 256 bits of entropy.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Guidelines for software development

ISM-0400 Development, testing, staging and production environments are segregated.
ISM-0401 Secure by Design principles and practices are followed throughout the software development
ISM-0402 Software is comprehensively tested for vulnerabilities, using SAST, DAST and SCA prior to
ISM-0971 The OWASP Application Security Verification Standard is used in the development of web app
ISM-1238 Threat modelling is used in support of the software development life cycle.
ISM-1239 Robust web application frameworks are used in the development of web applications.
ISM-1240 Validation and sanitisation are performed on all input received over the internet by softw
ISM-1241 Output encoding is performed on all output produced by web applications.

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls