Document Details

Threat Modeling Tool Session Management
Home / Scan #41 / Threat Modeling Tool Session Management
Sad Tux - Windows bias detected
This page contains Windows bias

About This Page

This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
GitHub View on GitHub 📚 View on Microsoft Learn

Bias Analysis

Detected Bias Types
windows_first
missing_linux_example
windows_tools
powershell_heavy
Summary
The documentation is heavily focused on Windows-centric technologies and patterns, such as ASP.NET, ADFS, web.config, and PowerShell commands. All code/configuration examples are for Windows/.NET environments, with no mention of Linux, cross-platform frameworks, or alternative approaches. Linux equivalents, such as configuration for NGINX/Apache, Java/Python web frameworks, or shell commands, are entirely absent.
Recommendations
  • Provide parallel examples for popular Linux-based web frameworks (e.g., Django, Flask, Express.js, Spring) for session management, CSRF protection, and secure cookie handling.
  • Include configuration examples for Linux web servers (e.g., NGINX, Apache) showing how to enforce secure and HttpOnly cookies.
  • When mentioning PowerShell or Windows-specific tools (e.g., Set-ADFSRelyingPartyTrust), offer equivalent bash or CLI commands for Linux-based identity providers (e.g., Shibboleth, Keycloak, or SAML/OIDC providers).
  • Reference cross-platform libraries for session and security management, such as OAuth2 libraries in Python, Node.js, or Java.
  • Structure sections so that Windows and Linux approaches are presented with equal prominence, or explicitly note when a mitigation is Windows-only.
  • Add a table or matrix mapping each mitigation to both Windows and Linux/cross-platform implementations.
GitHub Create Pull Request

Scan History

Date Scan Status Result
2026-01-14 00:00 #250 in_progress Biased Biased
2026-01-13 00:00 #246 completed Biased Biased
2026-01-11 00:00 #240 completed Biased Biased
2026-01-10 00:00 #237 completed Biased Biased
2026-01-09 00:34 #234 completed Biased Biased
2026-01-08 00:53 #231 completed Biased Biased
2026-01-06 18:15 #225 cancelled Clean Clean
2025-08-17 00:01 #83 cancelled Clean Clean
2025-07-13 21:37 #48 completed Biased Biased
2025-07-12 23:44 #41 cancelled Biased Biased

Flagged Code Snippets

Set-ADFSRelyingPartyTrust -TargetName "<RelyingPartyWebApp>" -ClaimsProviderName @("Active Directory") -TokenLifetime 15 -AlwaysRequireAuthentication $true

  <system.identityModel.services>
    <federationConfiguration>
      <!-- Set requireSsl=true; domain=application domain name used by FedAuth cookies (Ex: .gdinfra.com); -->
      <cookieHandler requireSsl="true" persistentSessionLifetime="0.0:15:0" />
      <!-- Set requireHttps=true; -->
      <wsFederation passiveRedirectEnabled="true" issuer="http://localhost:39529/" realm="https://localhost:44302/" reply="https://localhost:44302/" requireHttps="true"/>
      <!--
      Use the code below to enable encryption-decryption of claims received from ADFS. Thumbprint value varies based on the certificate being used.
      <serviceCertificate>
        <certificateReference findValue="4FBBBA33A1D11A9022A5BF3492FF83320007686A" storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" />
      </serviceCertificate>
      -->
    </federationConfiguration>
  </system.identityModel.services>