Cookies lacking httponly and secure flag

[Joshua Sneed]

Jira Software 7.0.11, RHEL 8, miniOrange SAML Single Sign-On plugin.

When my security team runs scans on the instance, it is finding the cookies below without a secure flag or httponly set. The JSESSIONID is correct, but the other three are not. I have attempted several changes to files in ../jira/conf/ without luck.

>POST /plugins/servlet/saml/auth HTTP/1.1 response cookies w/out secure flag or httponly set:
Set-Cookie: JSESSIONID=6E9D0ACB3A0C20D58353E84371CB6D5D; Path=/; Secure; HttpOnly
Set-Cookie: SESSIONCOOKIE=SessionCookie; Expires=Thu, 22-Mar-2018 19:45:31 GMT; Path=/
Set-Cookie: LOGOUTCOOKIE=fd240320-cae9-4dc2-b317-b9d5f68c02fa; Path=/
Set-Cookie: SAMLCOOKIE=v9cHZqt0krk6osPa+RfytKA1ZD238kt2VXb0Qqo786le523vH04FbajQjgquKA8m; Path=/

[Ankit]

Hi Joshua,

This is a pretty old thread but just wanted to let you know that the httponly and secure cookies fix is there in the latest versions of the miniOrange SAML plugins for all Atlassian platforms. You can update to the latest version and reach out to us using the support widget provided in the app if you face any issues.

[Joshua Sneed]

It turns out that was the solution. All we were able to do was remove the Secure and httponly flags from the JSESSIONID cookie. Put everything back in place and leaned on the vendor. They had a patch out within 12 hours that fixed the problem.

[Boris Berenberg - Atlas Authority]

Most vendors in this ecosystem are pretty responsive to things like this.

[Boris Berenberg - Atlas Authority]

I would test this on Jira 7.8 and see how they are set up there without a SAML plugin. If the issue is gone, then try putting the SAML plugin back in. If the issue is with the SAML plugin I suggest you reach out to the vendor and see if they are willing to change it. If the issue is still in Jira then you can file a ticket at https://jira.atlassian.com