{"id":6849,"date":"2023-04-12T22:49:49","date_gmt":"2023-04-12T22:49:49","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=6849"},"modified":"2023-06-05T09:35:00","modified_gmt":"2023-06-05T09:35:00","slug":"cookies-missing-attributes-in-rdweb-gateway","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/cookies-missing-attributes-in-rdweb-gateway","title":{"rendered":"Cookies Missing Attributes in RDWeb Gateway"},"content":{"rendered":"\n

The HTTPOnly attribute makes cookies inaccessible to JavaScript. Additionally, the Secure attribute
ensures that the cookie may only be transmitted over HTTPS. Cookies used by the application did
not have the HTTPOnly or Secure attribute set. This included but was not limited to the session
cookie PTISessionID.<\/p>\n\n\n\n


Risk Rating \u2013 Medium (Likelihood: Unlikely; Impact: Moderate)
These cookies are accessible by client-side scripts and can be stolen in a cross-site scripting attack. In
the case of a session or user identification cookie, this can lead to account compromise<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Enable Secure Flag in IIS
<\/strong>To enable secure flag in IIS, it is better to use URL Rewrite and add the following to your web.config file<\/p>\n\n\n\n

<system.webServer>\n  <rewrite>\n    <outboundRules>\n      <rule name=\"Use only secure cookies\" preCondition=\"Unsecured cookie\">\n        <match serverVariable=\"RESPONSE_SET_COOKIE\" pattern=\".*\" negate=\"false\" \/>\n        <action type=\"Rewrite\" value=\"{R:0}; secure\" \/>\n      <\/rule>\n      <preConditions>\n        <preCondition name=\"Unsecured cookie\">\n          <add input=\"{RESPONSE_SET_COOKIE}\" pattern=\".\" \/>\n          <add input=\"{RESPONSE_SET_COOKIE}\" pattern=\"; secure\" negate=\"true\" \/>\n        <\/preCondition>\n      <\/preConditions>\n    <\/outboundRules>\n  <\/rewrite>\n<\/system.webServer><\/code><\/pre>\n\n\n\n
Pre-Conditions wasn’t working on another site so I used this<\/p>\n\n\n\n
<rewrite>\n        <outboundRules>\n            <rule name=\"Add HttpOnly\">\n                <match serverVariable=\"RESPONSE_Set_Cookie\" pattern=\".+\" \/>\n                <conditions>\n                    <add input=\"{R:0}\" pattern=\"; HttpOnly\" negate=\"true\" \/>\n                <\/conditions>\n                <action type=\"Rewrite\" value=\"{R:0}; HttpOnly\" \/>\n            <\/rule>\n            <rule name=\"Add Secure\">\n                <match serverVariable=\"RESPONSE_Set_Cookie\" pattern=\".+\" \/>\n                <conditions>\n                    <add input=\"{R:0}\" pattern=\"; Secure\" negate=\"true\" \/>\n                <\/conditions>\n                <action type=\"Rewrite\" value=\"{R:0}; Secure\" \/>\n            <\/rule>\n        <\/outboundRules>\n    <\/rewrite><\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
The HTTPOnly attribute makes cookies inaccessible to JavaScript. Additionally, the Secure attributeensures that the cookie may only be transmitted over HTTPS. Cookies used by the application didnot […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-6849","post","type-post","status-publish","format-standard","hentry","category-research"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t