STIGQter: STIG Summary: Apache Server 2.4 UNIX Site Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application.

DISA Rule

SV-214288r612241_rule

Vulnerability Number

V-214288

Group Title

SRG-APP-000223-WSR-000011

Rule Version

AS24-U2-000470

Severity

CAT II

CCI(s)

• CCI-001664 - The information system recognizes only session identifiers that are system-generated.

Weight

10

Fix Recommendation

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Add or configure the following line:

"Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;secure"

Add the "secure" attribute to the JavaScript set cookie in any application code:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

HttpOnly cannot be used since by definition this is a cookie set by JavaScript.

Restart www_server and Apache.

Check Contents

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Search for the "Header" directive:

# cat /<path_to_file>/httpd.conf | grep -i "Header"

If "HttpOnly" "secure" is not configured, this is a finding.

"Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;secure"

Review the code. If, when creating cookies, the following is not occurring, this is a finding:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

Vulnerability Number

V-214288

Documentable

False

Rule Version

AS24-U2-000470

Severity Override Guidance

Determine the location of the "HTTPD_ROOT" directory and the "httpd.conf" file:

# httpd -V | egrep -i 'httpd_root|server_config_file'
-D HTTPD_ROOT="/etc/httpd"
-D SERVER_CONFIG_FILE="conf/httpd.conf"

Search for the "Header" directive:

# cat /<path_to_file>/httpd.conf | grep -i "Header"

If "HttpOnly" "secure" is not configured, this is a finding.

"Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;secure"

Review the code. If, when creating cookies, the following is not occurring, this is a finding:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

Check Content Reference

M

Target Key

3997

Comments