Cookie Does Not Contain HTTPOnly Attribute Security Vulnerability

During QUALYS Web Application Scanning of user system like Oracle Fusion (Integration layer), if one is facing the below security vulnerability, then follow the steps mentioned in the solution.

ID and Name

150123 and Cookie Does Not Contain The “HTTPOnly” Attribute

Threat

The cookie does not contain the “HTTPOnly” attribute.

Impact

Cookies without the “HTTPOnly” attribute are permitted to be accessed via JavaScript. Cross-site scripting attacks can steal cookies which could lead to user impersonation or compromise of the application account.

Solution

• Go to below location of Oracle Fusion server: /<Env_Name>/products/middleware/<Server_Name>/server/lib/consoleapp/webapp/WEB-INF
• Edit File Name:  weblogic.xml
• Add tag within existing “<session-descriptor>”: <http-only>true</http-only>

NOTE: Please restart Admin and all the other SOA and OSB managed servers, post the above changes.