Network Management

Secure flags on cookies are missing in Orion

When ASP.NET_SessionID and .ASPXAUTH cookies do not have Secure flags, you might be notified about detected vulnerabilities on the server. This might be because you moved your Orion Web Console from HTTP to HTTPS. See possible resolutions.

First published date

4/3/2020 4:41 AM

Last published date

4/3/2020 4:41 AM

Overview

When a cookie has the Secure attribute, the user agent includes the cookie in an HTTP request only if the request is transmitted over a secure channel (typically HTTP over Transport Layer Security (TLS) [RFC2818]). Secure flags for cookies thus help mitigate Man-In-The-Middle attacks.

ASP.NET_SessionId and .ASPXAUTH cookies should obtain the Secure flag.

Product section

Orion Platform

Cause

When Secure flags on ASP.NET_SessionID and .ASPXAUTH cookies are missing, you probably configured your Orion Platform with HTTP, logged in and reconfigured to HTTPS, and logged in to the Orion Web Console again.

Resolution

When you move the Orion Platform to HTTPS, use one of the following workarounds:

Change the server name.
Make sure all users log out.
Make sure all users clear browser cookies for Orion.

More details:

Task 5: Complete the Configuration wizard in Install or upgrade products in an existing Orion deployment
Configure the Orion Web Console to use SSL

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.