Jira Secure Attribute in Encrypted Session Cookie

Hi Atlassian Team,

we had a Pentest and would like to know how to deal with the following results and what type of Support we can have (if any) from Atlassian in here:

Application Error

forging a request that contains parameters or parameter values other than the ones expected by the application

 

Check incoming requests for the presence of all expected parameters and values.

http://cwe.mitre.org/data/definitions/550.html

Missing Secure Attribute in Encrypted Session Cookie

Basically the only required attribute for the cookie is the "name" field. Common optional attributes are: "comment", "domain", "path", etc. The "secure" attribute must be set accordingly in order to prevent to cookie from being sent unencrypted. RFC 2965 states: "The Secure attribute (with no value) directs the user agent to use only (unspecified) secure means to contact the origin server whenever it sends back this cookie, to protect the confidentially and authenticity of the information in the cookie." For further reference please see the HTTP State Management Mechanism RFC 2965 at: http://www.ietf.org/rfc/rfc2965.txt and for "Best current practice" for use of HTTP State Management please see http://tools.ietf.org/html/rfc2964

CWE-522 http://cwe.mitre.org/data/definitions/522.html,

CWE-718 http://cwe.mitre.org/data/definitions/718.html,

CWE-724 http://cwe.mitre.org/data/definitions/724.html,

CWE-928 http://cwe.mitre.org/data/definitions/928.html,

CWE-930 http://cwe.mitre.org/data/definitions/930.html, PCIDSS-6.5.10

 

Thank you in Advance

Best Regards

Leszek Lewandowski

0 answers

Suggest an answer

Log in or Sign up to answer
How to earn badges on the Atlassian Community

How to earn badges on the Atlassian Community

Badges are a great way to show off community activity, whether you’re a newbie or a Champion.

Learn more
Community showcase
Posted Wednesday in Jira

Join our webinar: How 1B+ feature flag events helped us build the new Jira

Every time you release software, there's a bit of risk – that there's a bug, that something breaks, or that the feature doesn't resonate with customers. Feature flagging helps make high stakes s...

111 views 0 3
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you