Cookie Security behaviour

[quekier]

Hi community

I've been configuring our Fortiweb 400c and we wanted to set a rule to alert when a cookie is sent without the secure flag set.

We configure the rule following those instructions:

http://help.fortinet.com/fweb/582/Content/FortiWeb/fortiweb-admin/cookie_security.htm

We have set on the configuration flag "secure flag" and the action to "alert". With that we expect that all cookies that are sent over a https channel have the secure flag set.

Our doubts are related to Fortweb Session Management cookies. We have also set it. That feature adds its own cookie called cookiession1 and surprisingly it does not have the secure flag. Our traffic is always https. Shouldn't be set that flag also for that cookie? May be Fortiweb plans to use the same cookie in case the webapp has a mixture of http and https traffic. May be is that the reason that cookie does not have the secure flag set on? Or is there something we are missing o misunderstanding?

Regards.

Q.K.

[Ferry_k · Accepted solution]

Hi Que,

In 5.8.5 we enhanced FortiWeb specific cookies and securtiy flags to better address PCI VA scans. A new CLI command allows settings HTTPOnly and Secure flags to all FortiWeb cookies. All or nothing command, no per cookie configuration:

1. cookiesession1
    Used by session management
2. cookiesession2
    Used by server balancer persistent cookie
3. cookiesession3
    Used by Site Publish
4. cookiesession4 and cookiesession5
    Used by Device Tracking feature.

Secure flag will be added to HTTPS traffic only.

See Mantis 0272194. 

New CLI commands:

set internal-cookie-httponly {enable | disable}

set internal-cookie-secure {enable | disable}

[quekier]

Many thanks, that was exactly my doubt.