Details

The ‘SECURE’ cookie attribute instructs web browsers to only send the cookie through an encrypted HTTPS (SSL/TLS) connection. This session protection mechanism is mandatory to prevent the disclosure of the session ID through MitM (Man-in-the-Middle) attacks. It ensures that an attacker cannot simply capture the session ID from web browser traffic.

Solution

Set the value of parameter SESSION_COOKIE_SECURE in /etc/openstack-dashboard/local_settings.py to True

Supportive Information

The following resource is also helpful.

• http://docs.openstack.org/security-guide/dashboard/checklist.html

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Unix.

References

• 800-53|SC-23.

Source

• Tenable.com/audits