2507150 - Cannot set HttpOnly for PortalAlias and SAPWP_active cookies | SAP Knowledge Base Article

SAP Knowledge Base Article - Preview

2507150 - Cannot set HttpOnly for PortalAlias and SAPWP_active cookies

Symptom

  • PortalAlias and SAPWP_active are cookies set by the Netweaver Application server that do not have 'HttpOnly' attribute. This may have been hightlighted during a vulnerability scan for example.
  • You would like to ensure that these cookies are set with 'HttpOnly' attribute.
  • There are no properties available that can be configured to set HttpOnly for the cookies.

Read more...

Environment

  • EP Release Independent
  • SAP NetWeaver
  • SAP Composition Environment

Product

SAP Composition Environment all versions ; SAP NetWeaver 2004 ; SAP NetWeaver 7.0 ; SAP NetWeaver 7.1 ; SAP NetWeaver 7.2 ; SAP NetWeaver 7.3 ; SAP NetWeaver 7.4 ; SAP NetWeaver 7.5 ; SAP enhancement package 1 for SAP NetWeaver 7.0 ; SAP enhancement package 1 for SAP NetWeaver 7.3 ; SAP enhancement package 2 for SAP NetWeaver 7.0

Keywords

Enterprise Portal 7.0, EP 7.0, Enterprise Portal 7.01, EP 7.01, Enterprise Portal 7.02, EP 7.02, Enterprise Portal 7.03, EP 7.03, Enterprise Portal 7.1, EP 7.1, Enterprise Portal 7.2, EP 7.2, Enterprise Portal 7.30, EP 7.30, Enterprise Portal 7.31, EP 7.31, Enterprise Portal 7.40, EP 7.4, Enterprise Portal 7.50, EP 7.5, SAPWP_active_Enforce_Secure_Cookie, portal.alias.security.enforce_secure_cookie, flag, JSESSIONID/JSESSIONMARKID/saplb_ , KBA , EP-PIN-AI , Application Integration , BC-JAS-SEC , Security, User Management , Problem

About this page

This is a preview of a SAP Knowledge Base Article. Click more to access the full version on SAP ONE Support launchpad (Login required).

Search for additional results

Visit SAP Support Portal's SAP Notes and KBA Search.