Home
Security Hardening
DISA STIG Apache Server 2.4 Windows Server V2R2

DISA STIG Apache Server 2.4 Windows Server V2R2

AS24-W1-000460 – The Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.
Details Captured sessions can be reused in ‘replay’ attacks. This requirement limits the ability of adversaries from capturing and continuing...
AS24-W1-000470 – Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application – Header HttpOnly secure
Details Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie,...
AS24-W1-000470 – Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application – Javascript setCookie
Details Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie,...
AS24-W1-000250 – The Apache web server must only contain services and functions necessary for operation – Welcome page
Details A web server can provide many features, services, and processes. Some of these may be deemed unnecessary or too...
AS24-W1-000480 – The Apache web server must accept only system-generated session identifiers.
Details Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless...
AS24-W1-000260 – The Apache web server must not be a proxy server.
Details A web server should be primarily a web server or a proxy server but not both, for the same...
AS24-W1-000500 – The Apache web server must generate unique session identifiers that cannot be reliably reproduced.
Details Communication between a client and the Apache web server is done using the HTTP protocol, but HTTP is a...
AS24-W1-000270 – The Apache web server must provide install options to exclude the installation of documentation, sample code, example applications, and tutorials.
Details Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server because...
AS24-W1-000530 – The Apache web server must generate unique session identifiers with definable entropy – ssl_module
Details Generating a session identifier (ID) that is not easily guessed through brute force is essential to deter several types...
AS24-W1-000280 – Apache web server application directories, libraries, and configuration files must only be accessible to privileged users.
Details When accounts used for web server features such as documentation, sample code, example applications, tutorials, utilities, and services are...

Prev Next

DISA STIG Apache Server 2.4 Windows Server V2R2

AS24-W1-000460 – The Apache web server must invalidate session identifiers upon hosted application user logout or other session termination.

AS24-W1-000470 – Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application – Header HttpOnly secure

AS24-W1-000470 – Cookies exchanged between the Apache web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating Apache web server and hosted application – Javascript setCookie

AS24-W1-000250 – The Apache web server must only contain services and functions necessary for operation – Welcome page

AS24-W1-000480 – The Apache web server must accept only system-generated session identifiers.

AS24-W1-000260 – The Apache web server must not be a proxy server.

AS24-W1-000500 – The Apache web server must generate unique session identifiers that cannot be reliably reproduced.

AS24-W1-000270 – The Apache web server must provide install options to exclude the installation of documentation, sample code, example applications, and tutorials.

AS24-W1-000530 – The Apache web server must generate unique session identifiers with definable entropy – ssl_module

AS24-W1-000280 – Apache web server application directories, libraries, and configuration files must only be accessible to privileged users.