FortiAppSec Cookie Security causing HTTP 403 Forbidden errors

Description

Enabling the Set HttpOnly Cookie feature in FortiWeb Cloud may cause applications to return HTTP 403 Forbidden errors if the application relies on JavaScript to read CSRF tokens from cookies.

Scope

FortiAppSec Cloud.

Solution

Symptoms

Users encounter HTTP 403 Forbidden (Authentication Error) responses on various application pages after a successful login. These errors occur specifically when Cookie Security features are enabled in FortiWeb Cloud. No corresponding security violations or blocks appear in the Web Application Firewall (WAF) event logs, even when the policy is set to Alert mode.

Root Cause

The issue is caused by the Set HttpOnly Cookie setting. When this feature is enabled, FortiWeb Cloud adds the HttpOnly flag to cookies passed to the browser. This flag prevents client-side JavaScript from accessing the cookie.

If the application is designed to read a Cross-Site Request Forgery (CSRF) token from a cookie using JavaScript, the browser cannot access the token. Consequently, the application receives a request with a missing or empty CSRF token and returns an HTTP 403 Access Denied response. Because this is an application-level authentication failure and not a WAF security block, no events are logged in the FortiWeb Cloud WAF logs.

Resolution

Disable the Set HttpOnly Cookie option while maintaining other security settings.

1. Log in to the FortiWeb Cloud console.

2. Navigate to the Cookie Security settings for the affected policy.

3. Disable the Set HttpOnly Cookie option.

4. Keep the Set Secure Cookie option enabled if the application supports it.

5. Save the configuration and test the application functionality.