Licenses: Updated the list of licenses and added a PDF containing all license texts
[check_mk.git] / .werks / 2392
blob4b1a249db6ff9cfb749b16eb05e686a367244d52
1 Title: Auth cookie is always using "httponly" flag
2 Level: 1
3 Component: multisite
4 Class: security
5 Compatible: compat
6 State: unknown
7 Version: 1.2.7i3
8 Date: 1435664667
10 All newly issued authentication cookies have the flag "httponly"
11 set now. This makes the cookie values inaccessible from scripts
12 executed in the browser, e.g. from Javascript. This secures the
13 cookie against some sorts of cookie stealing attempts.
15 See https://www.owasp.org/index.php/HttpOnly for details.