Ensure that a managed connection pool clears session-level state before handing a server connection to another client, so that no client observes or acts on state set by a previous client.
Reset Session State Between Pooled Connections
CCC.RDMS.CN09 · Data
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CP12 | Managed Connection Pooling | The service may be configured to place a managed connection pool in front of the database so that client connections are reused and bounded. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.TH09 | Session State Leaks Between Pooled Connections | A managed connection pool may reuse a server session for successive clients without resetting session-level state such as temporary tables, prepared statements, or an assumed role. State set by one client can then be read or acted on by another, impacting the confidentiality and integrity of data and obscuring which client performed an action. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.RDMS.CN09.AR01 | When a pooled server connection is reassigned to a new client, the pool MUST reset the session state of that connection before the new client can issue a statement. | tlp-amber, tlp-red |