httpOnly issue

[WolfShade]

Hello, all,

Where I work, we have to adhere to a very strict set of security protocols.  It makes my job difficult, most of the time.  More so than any other job I've ever worked.

We have to follow STIG guidelines, typically 300-400 pages of instructions.  One of these guidelines states that we have to use httpOnly in our application.cfc/cfm files.  We also set that in the web.xml file, so it should apply to all projects running under CF.

However, we have been informed by our security experts that there is a finding.  While they do see that we are using httpOnly, they claim that all of the session cookies have the httpOnly flag set, one of them is missing the secure flag.  No mention of which one.

What am I missing, here?

V/r,

^ _ ^

[Dave Watts]

Hard to say. I would recommend you do two things. First, ask for the finding details. Sometimes you'll be able to interpret and understand them better than the security person (who is often not an expert on how web applications work). Second, use a tool yourself that will let you look at the raw request and response headers, and see what you find yourself.

Dave Watts, Eidolon LLC