Portal security cookie settings and vulnerability

(0) Share

Report

Posted on by tacklers

150

A vulnerability has been flagged in our OOB vanilla portal by Qualys for the HTTPOnly attribute on the session cookie.

The Microsoft Portals security documentation reads that the setting:

Authentication/ApplicationCookie/CookieHttpOnly

Determines whether the browser should allow the cookie to be accessed by client-side JavaScript. Default: true

I am guessing that the default was not accessible by the assessment scan so have added the authentication setting in the configuration and set as 'True'. A new scan has been requested I will see what it reports.

If the vulnerability is flagged again I need some action options. If I set it to 'false' will anything break?

We have no client side javascript and not planning any. Any suggestions please. Cheers, richard U.K

Microsoft Docs Cookie settings

Categories:

Power Apps portals

I have the same question (0)

All responses (5)

Answers (2)

Prakash4691 1,332 on at

Like (0)

Report

@Gatwick

No it will not cause any issue.

You can set it to false or else deactivate the record from site settings.

If it answers your question, kindly give kudo and accept it as solution.

Regards,
Prakash

Was this reply helpful? Yes No
tacklers 150 on at

Like (0)

Report

Hi Prakash,

Thanks for taking the trouble to reply. Happy to issue big Kudos if what you say is right.

BUT right now I'm not sure. Do you know the reason it won't be an issue? Why does the option exist if it's irrelavent. I know I can delete it from site settings, that is where I set it up hoping the crawl would see it there as it may not be obvious if it is the default behavious.

Cheers, Richard

Was this reply helpful? Yes No
Prakash4691 1,332 on at

Like (0)

Report

@Gatwick

That option/setting w.r.t cookie will not come as OOB when we provision portal in power platform.

It looks like it has manually created and also you have mentioned that there will not be any client side scripting available. That particular setting is to access cookie which is available in browser via client side scripting.

I do not see any trouble by deactivating that record if it is of no use.

Regards,
Prakash

Was this reply helpful? Yes No
Verified answer

tacklers 150 on at

Like (0)

Report

Hi Prakash, thanks for the follow up, as per my original problem I realise the record does not exist in the configuration OOB, but the default activity is 'true', so I set it up in the expectation that our assessment scanner can then see it. When set as 'true' I guess that client side java script is allowed to access the cookie? Cheers, Richard

Was this reply helpful? Yes No
Verified answer

Prakash4691 1,332 on at

Like (0)

Report

@Gatwick ,

Yes, if it is set to true javascript can able to access browser cookie.

Regards,
Prakash

Was this reply helpful? Yes No