2

William has control over the generation of session identifiers

OWASP SCP
58, 59
OWASP ASVS
3.7.1
OWASP AppSensor
SE2
CAPEC
31, 60, 61
SAFECODE
28