Hi Atlassian Team,
we had a Pentest and would like to know how to deal with the following results and what type of Support we can have (if any) from Atlassian in here:
forging a request that contains parameters or parameter values other than the ones expected by the application
Check incoming requests for the presence of all expected parameters and values.
Missing Secure Attribute in Encrypted Session Cookie
Basically the only required attribute for the cookie is the "name" field. Common optional attributes are: "comment", "domain", "path", etc. The "secure" attribute must be set accordingly in order to prevent to cookie from being sent unencrypted. RFC 2965 states: "The Secure attribute (with no value) directs the user agent to use only (unspecified) secure means to contact the origin server whenever it sends back this cookie, to protect the confidentially and authenticity of the information in the cookie." For further reference please see the HTTP State Management Mechanism RFC 2965 at: http://www.ietf.org/rfc/rfc2965.txt and for "Best current practice" for use of HTTP State Management please see http://tools.ietf.org/html/rfc2964
CWE-930 http://cwe.mitre.org/data/definitions/930.html, PCIDSS-6.5.10
Thank you in Advance
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
We're bringing product updates and pro tips on teamwork to ten cities around the world.Save your spot