Securing the Proxy Session Cookie
The proxy session cookies store authentication information and other information in temporary memory that is transferred between the browser and the proxy. These cookies are deleted when the browser is closed. However if these cookies are sent through a non-secure channel, there is a threat of hackers intercepting the cookies and impersonating a user on Web sites. To stop this, you can use the following configuration options:
“Setting an Authentication Cookie with a Secure Keyword for HTTP” on page 792
“Preventing Cross-Site Scripting Vulnerabilities” on page 792
Setting an Authentication Cookie with a Secure Keyword for HTTP
You can configure the Access Gateway to force the HTTP services to have the authentication cookie set with the keyword secure.
To enable this option:
1
In the Administration Console, click
Devices
>
Access Gateways
>
Edit
>
Reverse Proxy /
Authentication
.
2
Select the
Enable Secure Cookies
option, then click
OK
twice.
3
Update the Access Gateway.
This option is used to secure the cookie when the Access Gateway is placed behind an SSL accelerator, such as the Cisco SSL accelerator, and the Access Gateway is configured to communicate by using only HTTP.
Preventing Cross-Site Scripting Vulnerabilities
Cross-site scripting vulnerabilities in Web browsers allow malicious sites to grab cookies from a vulnerable site. The goal of such attacks might be to perform session fixation or to impersonate the valid user. You can configure the Access Gateway to set its authentication cookie with the HttpOnly keyword, to prevent scripts from accessing the cookie.
To enable this option:
1
In the Administration Console, click
Devices
>
Access Gateways
>
Edit
>
Reverse Proxy /
Authentication
.
2
Enable the
Force HTTP-Only Cookies
option, then click
OK
twice.
3
Update the Access Gateway.
Preventing Cross-site Scripting Attacks
By default, Access Manager does extensive checks to prevent Cross-site Scripting (XSS) attacks.
However, Access Manager does not validate a JSP file if you have customized it. If you modify JSP files to customize the login, logout, error pages, and so forth, you must sanitize the JSP file to prevent
XSS attacks.
You need to perform either one of the following options to sanitize the customized JSP file:
“Option 1: HTML Escaping” on page 793
“Option 2: Filtering” on page 793
792
Securing Access Manager
