{"id":8352,"date":"2021-11-02T14:06:28","date_gmt":"2021-11-02T19:06:28","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=8352"},"modified":"2021-11-02T14:06:28","modified_gmt":"2021-11-02T19:06:28","slug":"fortify-on-demand-remediation-cookie-security-cookie-not-sent-over-ssl","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=8352","title":{"rendered":"Fortify on Demand Remediation: Cookie Security: Cookie not Sent Over SSL"},"content":{"rendered":"<p>This is another one that might be a false positive or might be legit. If you look at the <a href=\"https:\/\/www.php.net\/manual\/en\/function.setcookie.php\" target=\"_blank\" rel=\"noopener\">documentation for PHP&#8217;s setcookie function<\/a>, you will see the sixth parameter sets a restriction so cookies are only sent over secure connections. If you are not setting this restriction, the vulnerability is legitimate and you should sort that. But &#8230; if you followed PHP&#8217;s documentation and passed 1 to the parameter? FoD is falsely reporting that the parameter is not set to true.<\/p>\n<p><a href=\"https:\/\/www.rushworth.us\/lisa\/?attachment_id=8354\" rel=\"attachment wp-att-8354\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-8354\" src=\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/PHP-doc-setcookie.png\" alt=\"\" width=\"856\" height=\"373\" srcset=\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/PHP-doc-setcookie.png 856w, https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/PHP-doc-setcookie-300x131.png 300w, https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/PHP-doc-setcookie-768x335.png 768w, https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/PHP-doc-setcookie-750x327.png 750w\" sizes=\"auto, (max-width: 856px) 100vw, 856px\" \/><\/a><\/p>\n<p>In this case, the solution is easy enough. Change your perfectly valid 1<\/p>\n<p><a href=\"https:\/\/www.rushworth.us\/lisa\/?attachment_id=8355\" rel=\"attachment wp-att-8355\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-8355\" src=\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/2021-11-02-14_18_52-_manageNamingAlgorithms.php-Notepad.png\" alt=\"\" width=\"847\" height=\"39\" srcset=\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/2021-11-02-14_18_52-_manageNamingAlgorithms.php-Notepad.png 847w, https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/2021-11-02-14_18_52-_manageNamingAlgorithms.php-Notepad-300x14.png 300w, https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/2021-11-02-14_18_52-_manageNamingAlgorithms.php-Notepad-768x35.png 768w, https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/2021-11-02-14_18_52-_manageNamingAlgorithms.php-Notepad-750x35.png 750w\" sizes=\"auto, (max-width: 847px) 100vw, 847px\" \/><\/a><\/p>\n<p>to say true<\/p>\n<p><a href=\"https:\/\/www.rushworth.us\/lisa\/?attachment_id=8356\" rel=\"attachment wp-att-8356\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-8356\" src=\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/2021-11-02-14_19_11-manageNamingAlgorithms.php-Notepad.png\" alt=\"\" width=\"883\" height=\"47\" srcset=\"https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/2021-11-02-14_19_11-manageNamingAlgorithms.php-Notepad.png 883w, https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/2021-11-02-14_19_11-manageNamingAlgorithms.php-Notepad-300x16.png 300w, https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/2021-11-02-14_19_11-manageNamingAlgorithms.php-Notepad-768x41.png 768w, https:\/\/www.rushworth.us\/lisa\/wp-content\/uploads\/2021\/11\/2021-11-02-14_19_11-manageNamingAlgorithms.php-Notepad-750x40.png 750w\" sizes=\"auto, (max-width: 883px) 100vw, 883px\" \/><\/a><\/p>\n<p>And voila, the vulnerability has been remediated.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is another one that might be a false positive or might be legit. If you look at the documentation for PHP&#8217;s setcookie function, you will see the sixth parameter sets a restriction so cookies are only sent over secure connections. If you are not setting this restriction, the vulnerability is legitimate and you should &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[45,1437,35,69,1329],"class_list":["post-8352","post","type-post","status-publish","format-standard","hentry","category-coding","tag-coding","tag-fortify-on-demand","tag-php","tag-security","tag-web-coding"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/8352","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8352"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/8352\/revisions"}],"predecessor-version":[{"id":8357,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/8352\/revisions\/8357"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}