Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-24840

Session cookie not set with HttpOnly flag

XMLWordPrintable

    • Icon: Improvement Improvement
    • Resolution: Duplicate
    • Icon: Minor Minor
    • core

      The session cookie does not have HttpOnly flag set, so a malicious script could use it to forge a XSS attack. This isn't a direct security issue, as jenkins prevent arbitrary script to be included, just would offer a a second line of defense in case another security issue is detected.

          [JENKINS-24840] Session cookie not set with HttpOnly flag

          Nicolas De Loof created issue -
          Jesse Glick made changes -
          Labels New: security
          R. Tyler Croy made changes -
          Workflow Original: JNJira [ 158070 ] New: JNJira + In-Review [ 179720 ]
          Jesse Glick made changes -
          Link New: This issue duplicates JENKINS-27277 [ JENKINS-27277 ]
          Jesse Glick made changes -
          Resolution New: Duplicate [ 3 ]
          Status Original: Open [ 1 ] New: Resolved [ 5 ]

            Unassigned Unassigned
            ndeloof Nicolas De Loof
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: