Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The application must set the secure flag on session cookies.
Description
Discussion Text
Many web development frameworks such as PHP, .NET, ASP as well as application servers include their own mechanisms for session management. Whenever possible it is recommended to utilize the provided session management framework.
Setting the secure bit on session cookie ensures the session cookie is only sent via TLS/SSL HTTPS connections. This helps to ensure confidentiality as the session cookie is not able to be viewed by unauthorized parties as it transits the network.
Setting the secure flag on all cookies may also be warranted depending upon application design but at a minimum, the session cookie must always be secured.
Setting the secure bit on session cookie ensures the session cookie is only sent via TLS/SSL HTTPS connections. This helps to ensure confidentiality as the session cookie is not able to be viewed by unauthorized parties as it transits the network.
Setting the secure flag on all cookies may also be warranted depending upon application design but at a minimum, the session cookie must always be secured.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.