V-241584

Discussion

Cookies are a common way to save session state over the HTTP(S) protocol. If an attacker can compromise session data stored in a cookie, they are better able to launch an attack against the server and its applications. Session cookies stored on the server are more secure than cookies stored on the client. Therefore, tc Server must be configured correctly in order to generate and manage session cookies on the server. Managing cookies on the server provides a layer of defense to vRealize Automation. By default, tc Server is designed to manage cookies on the server. However, incorrect configuration can turn off the default feature.

Check Content

At the command prompt, execute the following command:

grep -E 'cookies=.false' /usr/lib/vmware-vcops/tomcat-enterprise/conf/context.xml

If the command produces any output, this is a finding.