The web server must restrict a consistent inbound source IP for the entire management session.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-264360	SRG-APP-000219	SRG-APP-000219-WSR-000190	SV-264360r1043178_rule	2025-02-12	4

Description
Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions. Application communication sessions are protected utilizing transport encryption protocols, such as TLS. TLS provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one way) or mutual (two way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other. This requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services will require the use of TLS mutual authentication (two-way/bidirectional).

Description

Authenticity protection provides protection against man-in-the-middle attacks/session hijacking and the insertion of false information into sessions. Application communication sessions are protected utilizing transport encryption protocols, such as TLS. TLS provides web applications with a means to be able to authenticate user sessions and encrypt application traffic. Session authentication can be single (one way) or mutual (two way) in nature. Single authentication authenticates the server for the client, whereas mutual authentication provides a means for both the client and the server to authenticate each other. This requirement addresses communications protection at the application session, versus the network packet, and establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted. Depending on the required degree of confidentiality and integrity, web services will require the use of TLS mutual authentication (two-way/bidirectional).

ℹ️ Check
Verify the web server limits authenticated client management sessions to initial session source IP. If the web server does not limit authenticated client management sessions to initial session source IP, this is a finding.

✔️ Fix
Configure the web server to restrict the management session to a consistent inbound IP for the entire management session.