MASWE-0024: the OWASP weakness with no test, and how to test it

MASWE-0024, “Sensitive Data Accessible After Session Termination”, sits under MASVS-AUTH-3. The weakness is simple: after logout or a session timeout, tokens and personal data are still reachable on the device, in storage, caches, WebView data or memory.

The next person who uses the device, a backup, or a later bug can reach them. On shared devices (a clinician's tablet, a merchant terminal) the next user may be signed in to someone else's data.

The OWASP MASTG has no test mapped to MASWE-0024. The closest is MASTG-TEST-0302 on iOS: a manual before/after comparison of the app's private storage and Keychain while you exercise the app. On Android, MASTG-TEST-0207 inspects data stored in the app sandbox at runtime. OWASP deprecated its process-memory test (MASTG-TEST-0060) without a replacement.

None of these is framed around logout. The question MASWE-0024 asks is not how a value is stored, but whether it is still there once the session has ended.

1. Run a debug build and log in with a test account. 2. Capture the app's private storage (preferences, databases, caches, WebView data, files) and, where the result is reliable, its memory. 3. Log out the way a user would. 4. Capture again.

5. Compare by value, not by location. Hash each secret with a key so you can match it even if it moved to another file or address, without writing the value anywhere. 6. Fail on what survived on disk. Treat memory-only survivors as evidence, and fail on them only where the runtime makes the result reliable.

Use a canary when you can: a fake token that the app generates in debug builds instead of the real one. If any copy of it survives, the test fails, with no doubt about whether the string was sensitive.

iOS (Swift): URLCache (Cache.db), UserDefaults, Core Data and SQLite (including the -wal file), cookies, and Keychain items that logout forgot to delete.

React Native: AsyncStorage (redux-persist's persist:root), MMKV, an auth SDK's session key such as Supabase or Firebase, and Sentry's user scope.

Flutter: shared_preferences keys under flutter.*, Hive boxes, and HTTP caches such as dio's.

Android: SharedPreferences XML, DataStore, Room databases, WebView cookies and local storage, and the OkHttp cache.

A PASS only means something when the capture covered most of the app's writable memory and every source was read. Otherwise the honest verdict is INCOMPLETE.

In React Native and Flutter, freed strings in the JavaScript or Dart heap stay until the garbage collector reuses the page. Memory-only hits there are evidence, not a failing test; the gate should rest on storage and on tracking the values you saw before logout.

WatchMemory automates this check: residue capture before and after logout, compare, and a PASS / FAIL / INCOMPLETE verdict, on the iOS Simulator and for debuggable Android builds (beta). Results map to MASWE-0024, MASVS-STORAGE and MASVS-AUTH-3.

It gives you evidence; it doesn't make an app compliant or certified. OWASP doesn't certify apps or tools.