STIGQter: STIG Summary: Apache Server 2.4 Windows Server Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application.

DISA Rule

SV-214332r505936_rule

Vulnerability Number

V-214332

Group Title

SRG-APP-000223-WSR-000011

Rule Version

AS24-W1-000470

Severity

CAT II

CCI(s)

• CCI-001664 - The information system recognizes only session identifiers that are system-generated.

Weight

10

Fix Recommendation

Add this line to "httpd.conf" file:

Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;secure

Add the secure attribute to the JavaScript set cookie:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

HttpOnly cannot be used since by definition this is a cookie set by JavaScript.

Restart the Apache service.

Check Contents

Review the <'INSTALL PATH'>\conf\httpd.conf file.

If "HttpOnly;secure" is not configured, this is a finding.

Review the code. If when creating cookies, the following is not occurring, this is a finding:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

Vulnerability Number

V-214332

Documentable

False

Rule Version

AS24-W1-000470

Severity Override Guidance

Review the <'INSTALL PATH'>\conf\httpd.conf file.

If "HttpOnly;secure" is not configured, this is a finding.

Review the code. If when creating cookies, the following is not occurring, this is a finding:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

Check Content Reference

M

Target Key

3998

Comments