Hi.
Am 08-03-2016 08:44, schrieb Krishna Kumar K K:
Thing is its failing in the vulnerability scan (nexpose tool is used)
saying cookie is not secure or httponly.
As Aapo said the request header is a client header.
This is only changeable at client side with some javascript code.
If you want to use such a solution you can try this module.
http://nginx.org/en/docs/http/ngx_http_addition_module.html
But to be more precise which request header do you want to change?
client request --> nginx request --> IBM WebSeal request --> Other
backend
<JavaScript> <Proxy set header> ??? ???
http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_set_header
You can also try to use the 'add_header ... ' that the client receive
the
additional header and send it back at the following requests.
http://nginx.org/en/docs/http/ngx_http_headers_module.html
As for the scanner he get's the cookie from the response not from the
request, afaik.
Maybe you can turn on the debug logging and see what the scanner gets as
response.
http://nginx.org/en/docs/debugging_log.html
Maybe you will need the nginx-debug package.
What's your system on which you run nginx?
Aleks
FROM: nginx [mailto:[email protected]] ON BEHALF OF Aapo
Talvensaari
SENT: Monday, March 07, 2016 11:34 PM
TO: [email protected]
SUBJECT: Re: secure and httponly cookies
On Tuesday, 8 March 2016, Krishna Kumar K K <[email protected]>
wrote:
I am able to modify the set-cookie header from the server to flag it
secure. I am trying to do the same in the request header as well.
Those flags are instructions to client. They don't have meaning on
request headers. Only on response headers.
_______________________________________________
nginx mailing list
[email protected]
http://mailman.nginx.org/mailman/listinfo/nginx
_______________________________________________
nginx mailing list
[email protected]
http://mailman.nginx.org/mailman/listinfo/nginx
