Many older web applications do not apply headers/tags that are now considered standard information security practices. For example:
- Pragma: no-cache
- Cache-Control: no-cache
- httpOnly and secure flags
Adding these controls can be achieved using ModSecurity without any needs to modify the application code.
In the case where I needed to modify the cookie headers to include these now controls I added the following to core rule set file: modsecurity_crs_16_session_hijacking.conf.
# # This rule will identify the outbound Set-Cookie SessionID data and capture it in a setsid # #addding httpOnly Header edit Set-Cookie "(?i)^(JSESSIONID=(?:(?!httponly).)+)$" "$1; httpOnly" Header set Cache-Control "no-cache, no-store, must-revalidate" Header set Pragma "no-cache" Header set Expires "0"
This adds the cookie controls we were after – Depending on your web application you may need to change ‘JSESSIONID’ to the name of the relevant cookie.
You can find the cookie name simply using browser tools such as Chrome’s Developer Tools (hit F12 in chrome). Load the page you want to check cookies for, click on the Resources tab:
After setting the HTTPOnly and Secure flags you can check the effectiveness using the Console table and listing the document cookies… which should now return nothing.
