Cookies lacking httponly and secure flag

Question

Jira Software 7.0.11, RHEL 8, miniOrange SAML Single Sign-On plugin.

When my security team runs scans on the instance, it is finding the cookies below without a secure flag or httponly set. The JSESSIONID is correct, but the other three are not. I have attempted several changes to files in ../jira/conf/ without luck.

>POST /plugins/servlet/saml/auth HTTP/1.1 response cookies w/out secure flag or httponly set:
Set-Cookie: JSESSIONID=6E9D0ACB3A0C20D58353E84371CB6D5D; Path=/; Secure; HttpOnly
Set-Cookie: SESSIONCOOKIE=SessionCookie; Expires=Thu, 22-Mar-2018 19:45:31 GMT; Path=/
Set-Cookie: LOGOUTCOOKIE=fd240320-cae9-4dc2-b317-b9d5f68c02fa; Path=/
Set-Cookie: SAMLCOOKIE=v9cHZqt0krk6osPa+RfytKA1ZD238kt2VXb0Qqo786le523vH04FbajQjgquKA8m; Path=/

Ankit_5decvz · Answer

Hi Joshua,

This is a pretty old thread but just wanted to let you know that the httponly and secure cookies fix is there in the latest versions of the miniOrange SAML plugins for all Atlassian platforms. You can update to the latest version and reach out to us using the support widget provided in the app if you face any issues.

Boris Berenberg - Atlas Authority · Answer

Most vendors in this ecosystem are pretty responsive to things like this.

Joshua Sneed · Answer

It turns out that was the solution. All we were able to do was remove the Secure and httponly flags from the JSESSIONID cookie. Put everything back in place and leaned on the vendor. They had a patch out within 12 hours that fixed the problem.