Werk #2392: Auth cookie is always using "httponly" flag
| Komponente | GUI |
| Titel | Auth cookie is always using "httponly" flag |
| Datum | 30.06.2015 |
| Checkmk-Editon | Checkmk Raw (CRE) |
| Checkmk-Version | 1.2.7i3 |
| Level | Kleine Änderung |
| Klasse | Sicherheitsfix |
| Kompatibilität | Kompatibel - benötigt kein manuelles Eingreifen |
All newly issued authentication cookies have the flag "httponly" set now. This makes the cookie values inaccessible from scripts executed in the browser, e.g. from Javascript. This secures the cookie against some sorts of cookie stealing attempts.
See https://www.owasp.org/index.php/HttpOnly for details.
Zur Liste aller Werks