Checkmk 2.0 is here! See what's new.

Werk #2392: Auth cookie is always using "httponly" flag

Component GUI
Title Auth cookie is always using "httponly" flag
Date Jun 30, 2015
Checkmk Editon Checkmk Raw (CRE)
Checkmk Version 1.2.7i3
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed

All newly issued authentication cookies have the flag "httponly" set now. This makes the cookie values inaccessible from scripts executed in the browser, e.g. from Javascript. This secures the cookie against some sorts of cookie stealing attempts.

See https://www.owasp.org/index.php/HttpOnly for details.

To the list of all Werks