Clarify 7.2.2 (previouly v5.0.be-3.1.3, v4.0.3-3.5.2)

[tghosth]

Previous wording:

#	Description	L1	L2	L3	CWE	NIST §
3.5.2	Verify the application uses session tokens rather than static API secrets and keys, except with legacy implementations.		✓	✓	798

Current wording:

#	Description	Level	#v5.0.be
7.2.2	[MODIFIED, MOVED FROM 3.5.2, LEVEL L2 > L1] Verify that the application uses either self-contained or reference tokens for session management, avoiding static API secrets and key.	1	v5.0.be-3.1.3

I propose:

"Verify that the application uses temporary self-contained or reference tokens for session management, avoiding static secrets and keys."

[elarlang]

For me the "temporary" is quite confusing here.

Note, that current wording is:

V7.2.2 Verify that the application uses either self-contained or reference tokens for session management. Static API secrets and keys should be avoided.

Proposal, combination of different pieces:

Verify that the application uses either self-contained or reference tokens for session management, i.e. not using static API secrets and keys.

The "avoid static" part for reference tokens is covered by requirements:

• V7.2.3 / v5.0.be-3.1.4 Verify that if reference tokens are used to represent user sessions, they are unique and generated using a cryptographically secure pseudo-random number generator (CSPRNG) and possess at least 128 bits of entropy.
• 7.2.4 / v5.0.be-3.1.5 Verify that the application generates a new session token on user authentication, including re-authentication, and terminates the current session token.

[tghosth]

Maybe we should say:

"Verify that the application uses either self-contained or reference tokens that are dynamically generated for session management, i.e. not using static API secrets and keys."