Checkmk 2.0 ist hier! Alle Neuigkeiten erfahren.

Werk #2392: Auth cookie is always using "httponly" flag

Komponente GUI
Titel Auth cookie is always using "httponly" flag
Datum 30.06.2015
Checkmk-Editon Checkmk Raw (CRE)
Checkmk-Version 1.2.7i3
Level Kleine Änderung
Klasse Sicherheitsfix
Kompatibilität Kompatibel - benötigt kein manuelles Eingreifen

All newly issued authentication cookies have the flag "httponly" set now. This makes the cookie values inaccessible from scripts executed in the browser, e.g. from Javascript. This secures the cookie against some sorts of cookie stealing attempts.

See https://www.owasp.org/index.php/HttpOnly for details.

Zur Liste aller Werks