STIGQter: STIG Summary: Apache Server 2.4 Windows Site Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jul 2020:

Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application.

DISA Rule

SV-102623r1_rule

Vulnerability Number

V-92535

Group Title

SRG-APP-000223-WSR-000011

Rule Version

AS24-W2-000470

Severity

CAT II

CCI(s)

• CCI-001664 - The information system recognizes only session identifiers that are system-generated.

Weight

10

Fix Recommendation

Add this line to the "httpd.conf" file:

Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;secure

Add the secure attribute to the JavaScript set cookie:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

"HttpOnly" cannot be used since by definition this is a cookie set by JavaScript.

Restart www_server and Apache.

Check Contents

Review the <'INSTALLED PATH'>\conf\httpd.conf file.

If "HttpOnly; secure" is not configured, this is a finding.

Review the code. If when creating cookies, the following is not occurring, this is a finding:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

Vulnerability Number

V-92535

Documentable

False

Rule Version

AS24-W2-000470

Severity Override Guidance

Review the <'INSTALLED PATH'>\conf\httpd.conf file.

If "HttpOnly; secure" is not configured, this is a finding.

Review the code. If when creating cookies, the following is not occurring, this is a finding:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

Check Content Reference

M

Target Key

3419

Comments