Highlighted

httpOnly issue

LEGEND ,
Jan 30, 2019

Copy link to clipboard

Copied

Hello, all,

Where I work, we have to adhere to a very strict set of security protocols.  It makes my job difficult, most of the time.  More so than any other job I've ever worked.

We have to follow STIG guidelines, typically 300-400 pages of instructions.  One of these guidelines states that we have to use httpOnly in our application.cfc/cfm files.  We also set that in the web.xml file, so it should apply to all projects running under CF.

However, we have been informed by our security experts that there is a finding.  While they do see that we are using httpOnly, they claim that all of the session cookies have the httpOnly flag set, one of them is missing the secure flag.  No mention of which one.

What am I missing, here?

V/r,

^ _ ^

Views

190

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more

httpOnly issue

LEGEND ,
Jan 30, 2019

Copy link to clipboard

Copied

Hello, all,

Where I work, we have to adhere to a very strict set of security protocols.  It makes my job difficult, most of the time.  More so than any other job I've ever worked.

We have to follow STIG guidelines, typically 300-400 pages of instructions.  One of these guidelines states that we have to use httpOnly in our application.cfc/cfm files.  We also set that in the web.xml file, so it should apply to all projects running under CF.

However, we have been informed by our security experts that there is a finding.  While they do see that we are using httpOnly, they claim that all of the session cookies have the httpOnly flag set, one of them is missing the secure flag.  No mention of which one.

What am I missing, here?

V/r,

^ _ ^

Views

191

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Jan 30, 2019 0
Adobe Community Professional ,
Jan 30, 2019

Copy link to clipboard

Copied

Hard to say. I would recommend you do two things. First, ask for the finding details. Sometimes you'll be able to interpret and understand them better than the security person (who is often not an expert on how web applications work). Second, use a tool yourself that will let you look at the raw request and response headers, and see what you find yourself.

Dave Watts, Eidolon LLC

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
Jan 30, 2019 0