STIGQter: STIG Summary: Apache Server 2.4 Windows Site Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 01 Apr 2026:

Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application.

DISA Rule

SV-214376r1043180_rule

Vulnerability Number

V-214376

Group Title

SRG-APP-000223-WSR-000011

Rule Version

AS24-W2-000470

Severity

CAT II

CCI(s)

• CCI-001664 - Recognize only session identifiers that are system-generated.

Weight

10

Fix Recommendation

Add this line to the "httpd.conf" file:

Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;secure

Add the secure attribute to the JavaScript set cookie:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

"HttpOnly" cannot be used since by definition this is a cookie set by JavaScript.

Restart www_server and Apache.

Check Contents

Review the <'INSTALLED PATH'>\conf\httpd.conf file.

If "HttpOnly; secure" is not configured, this is a finding.

Review the code. If when creating cookies, the following is not occurring, this is a finding:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

Vulnerability Number

V-214376

Documentable

False

Rule Version

AS24-W2-000470

Severity Override Guidance

Review the <'INSTALLED PATH'>\conf\httpd.conf file.

If "HttpOnly; secure" is not configured, this is a finding.

Review the code. If when creating cookies, the following is not occurring, this is a finding:

function setCookie() { document.cookie = "ALEPH_SESSION_ID = $SESS; path = /; secure"; }

Check Content Reference

M

Target Key

3999