How to prevent information disclusore by renaming "cookiesession1"?

Forum|Forum|5 years ago
July 14, 2021
2 replies
3243 views

Hi,

For the first HTTP/HTTPS request from a client, FortiWeb embeds a cookie in the response’s Set-Cookie: field in the HTTP header. It is named cookiesession1. you will see this cookie name (coockiesession1) if you capture a HTTP/HTTPS packet Since this is a uniqe cookie name, a disclusore happened becuase the attacker notices that there is a fortiweb appliance on the traffic of backend servers. my question is How can i rename "cookiesession1" in order to prevent information disclusore from our network?

emnoc

New Member

Good question

I believe in your waf security policy you can set cookie name and define a cookie name. In all fairness, you should be using https and encrypted cookie response but in this case you want to not use cookiesession1 as common cookie name in the response.

e.g ( using www.fortinet.com )

Set-Cookie: cookiesession1=678A3E62IJKLMNQRSTUV012456780E56;Expires=Thu, 14 Jul 2022 12:06:20 GMT;Path=/;HttpOnly

That tells me they have a fortinet product stuck in the path ;) Search for "set cookie_name" in the cli guide and give us an update if you do figure it out.

Ken Felix

fortikarAuthor

New Member

emnoc wrote:
Good question

I believe in your waf security policy you can set cookie name and define a cookie name. In all fairness, you should be using https and encrypted cookie response but in this case you want to not use cookiesession1 as common cookie name in the response.

e.g ( using www.fortinet.com )

Set-Cookie: cookiesession1=678A3E62IJKLMNQRSTUV012456780E56;Expires=Thu, 14 Jul 2022 12:06:20 GMT;Path=/;HttpOnly That tells me they have a fortinet product stuck in the path ;) Search for "set cookie_name" in the cli guide and give us an update if you do figure it out. Ken Felix

unfortunately there isn't any content. i reviewed all of available fortiweb documents and i didn't see anything. i guess that fortinet has omitted this important subject. and i wish this feature be added to fortiweb on next updates anyway,if this option exists on fortiweb please inform me by your knowledge

Sign up

Login with SSO

Login to the community

Login with SSO