We have received the below finding from an IT audit.

Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an SSL connection to explicitly state secure on them

Can someone can explain what they are and how to secure them?


A cookie that has the secure attribute set will only be sent over an HTTPS connection, so if the client in future attempts to connect to the server over unencrypted HTTP, the cookie will not be sent with the request, and will not, therefore, be exposed to theft.

As to how to ensure your specific cookie is marked as secure, you will have to consult with the application owners or documentation in order to ascertain what steps you will need to take.

| improve this answer | |

When the cookie is created by the web app, there are optional flags which can be set to restrict how the cookie is used. With no flags set, the cookies can be read over an insecure connection or may be used in unexpected and unplanned ways.

To remediation your finding, you will need to ensure that the correct flags are set when the cookie is created. In a normal web app you would do this by modifying the source code at the point where the cookie is created or if you are using a library function to create the cookie, it may be an optional parameter.

For some general information, consult OWASP SecureFlag page.

Since your noted Exchange 2010, I am assuming this is on the web based email component for users to read their email in the browser as opposed to Outlook, etc. This should be an option in your web.config which may be found under a path like Program Files\Microsoft\Exchange Server\V14\ClientAccess\Owa. After your browsing, I see this was already answered on ServerFault

<httpCookies httpOnlyCookies="true" requireSSL="true"/>
| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.