Details

CSRF (Cross-site request forgery) is an attack which forces an end user to execute unauthorized commands on a web application in which he/she is currently authenticated. A successful CSRF exploit can compromise end user data and operations in case of normal user. If the targeted end user has admin privileges, this can compromise the entire web application.

Solution

Set the value of parameter CSRF_COOKIE_SECURE in /etc/openstack-dashboard/local_settings.py to True

Supportive Information

The following resource is also helpful.

• http://docs.openstack.org/security-guide/dashboard/checklist.html

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Unix.

References

• 800-53|SC-23.

Source

• Tenable.com/audits