Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 Nagaraj Ponnurangam (NagarajP0101)
ING Belgium SA NV

ING Belgium SA NV
BE
NagarajP0101 Member since 2017 54 posts
ING Belgium SA NV
Posted: Jan 26, 2018
Last activity: Oct 12, 2018
Posted: 26 Jan 2018 7:51 EST
Last activity: 12 Oct 2018 14:46 EDT
Closed

Security issues after Pen test - SSL Cookie without security flag set

Recently we installed AES in test server and it undergone pen test. There is one finding related to SSL cookie. Please find below problem decription

Problem Description : The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.

I followed link https://pdn.pega.com/support-articles/how-add-secure-and-httponly-attributes-cookie and found that settings <env name="HTTP/SetSecureCookie" value="true" that solved issue in other version of pega. Kindly we can go for same fix in Pega 7.3.0?

Please advise.

***Edited by Moderator Marissa to update categories, update group tags***

To see attachments, please log in.
Pega Autonomic Event Services
Low-Code App Development
Security
System Administration

Posted: 6 years ago
Posted: 29 Jan 2018 8:32 EST
Andy Werden (WERDA)
PEGA
Senior Fellow Technology Architect
Pegasystems Inc.
US

yes; platform 73 supports setting cookies as secure

btw - if this is a new AES 73 installation, I suggest you use the latest platform version - 7.3.1

To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice