Apache Tomcat Application Server 9 Security Technical Implementation Guide

The Apache Tomcat Application Server 9 Security Technical Implementation Guide (V3 R5) has 79 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

79STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R5

CurrentPublished Wed Sep 30 2026

Cookies must have secure flag set.

Apache Tomcat Application Server 9 Security Technical Implementation Guide

Assessment Title

Rule Text

Cookies must have secure flag set.

Description

Discussion Text

It is possible to steal or manipulate web application session and cookies without having a secure cookie. Configuring the secure flag injects the setting into the response header.

The $CATALINA_BASE/conf/web.xml file controls how all applications handle cookies via the <cookie-config> element.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-222932

Rule

SV-222932r1264523_rule

Severity

medium

Rule Version

TCAT-AS-000070

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the Tomcat server console, run the following command:

sudo grep -i -B10 -A1 \/cookie-config $CATALINA_BASE/conf/web.xml

If the command returns no results or if the <secure> element is not set to true, this is a finding.

EXAMPLE:
<session-config>
   <session-timeout>15</session-timeout>
     <cookie-config>
       <http-only>true</http-only>
        <secure>true</secure>
     </cookie-config>
</session-config>

Implementation Procedure

Fix Text

From the Tomcat server console as a privileged user:

edit the $CATALINA_BASE/conf/web.xml

If the cookie-config section does not exist it must be added. Add or modify the <secure> setting and set to true.

EXAMPLE:
<session-config>
   <session-timeout>15</session-timeout>
     <cookie-config>
       <http-only>true</http-only>
        <secure>true</secure>
     </cookie-config>
</session-config>

STIG check 5 of 79 in the Apache Tomcat Application Server 9 STIG checklist

← Previous · V-222931Default password for keystore must be changed.Next · V-222933 →Cookies must have http-only flag set.