Per OWASP ASVS V3: implement secure session management. Requirements include (a) generate cryptographically random session tokens of sufficient entropy + (b) protect tokens against session fixation + replay + theft + (c) implement secure cookie attributes (Secure + HttpOnly + SameSite + Path + Domain + (d) implement session timeout (idle + absolute) + appropriate to risk + (e) implement session termination on logout + password change + privilege change including all-device logout + (f) protect against session ID enumeration + (g) implement CSRF protection via SameSite cookies + token validation + or framework-provided mechanisms.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.