SAP Note 943336
SAP security note 943336, "HttpOnly cookie attribute". Below are the SAP recommended solution and the affected software components.
Description
Solution
To enable the HttpOnly attribute for system cookies, follow these steps:
- Enable HttpOnly attribute: set the SystemCookiesDataProtection property of the HTTP Provider Service to true. This action will append the HttpOnly attribute to the relevant system cookies, enhancing their security.
- Maintaining default behavior: if your application relies on accessing these cookies via client-side scripts, you may choose to keep the SystemCookiesDataProtection property set to false. This will retain the default behavior of the J2EE Engine from SP17 or earlier releases.
Affected components
- SAP-JEE: Applicable to versions 6.40 SP17 (NW04s SP08) and higher, as well as all releases of SAP NW 7.10/CE.
Full note on SAP: SAP Support Launchpad note 943336
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].