Cookies exchanged between the web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies.
Overview
Finding ID
Version
Rule ID
IA Controls
Severity
V-206438
SRG-APP-000439-WSR-000155
SV-206438r961632_rule
Medium
Description
Cookies can be sent to a client using TLS/SSL to encrypt the cookies, but TLS/SSL is not used by every hosted application since the data being displayed does not require the encryption of the transmission. To safeguard against cookies, especially session cookies, being sent in plaintext, a cookie can be encrypted before transmission. To force a cookie to be encrypted before transmission, the cookie Secure property can be set.