Third party cookies must be blocked

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-0015	DTBC-0015	SV-0015r1_rule		Medium

Description
Blocks third party cookies. Enabling this setting prevents cookies from being set by web page elements that are not from the domain that is in the browser's address bar. Disabling this setting allows cookies to be set by web page elements that are not from the domain that is in the browser's address bar and prevents users from changing this setting. If this policy is left not set, third party cookies will be enabled but the user will be able to change that.

Description

Blocks third party cookies. Enabling this setting prevents cookies from being set by web page elements that are not from the domain that is in the browser's address bar. Disabling this setting allows cookies to be set by web page elements that are not from the domain that is in the browser's address bar and prevents users from changing this setting. If this policy is left not set, third party cookies will be enabled but the user will be able to change that.

STIG	Date
Google Chrome STIG Draft	2012-09-25

Details

Check Text ( C-0015r1_chk )
Universal method (Requires Chrome Browser v15 or later): 1. In the omnibox (address bar) type chrome://policy 2. If BlockThirdPartyCookies is displayed under the Policy Name column and it is set to true under the Policy Value column, then this is not a finding. Windows method: 1. Start regedit 2. Navigate to HKLM\Software\Policies\Google\Chrome\ 3. If the BlockThirdPartyCookies value name does not exist or its value data is not set to 1, then this is a finding.

Check Text ( C-0015r1_chk )

Universal method (Requires Chrome Browser v15 or later):
1. In the omnibox (address bar) type chrome://policy
2. If BlockThirdPartyCookies is displayed under the Policy Name column and it is set to true under the Policy Value column, then this is not a finding.

Windows method:
1. Start regedit
2. Navigate to HKLM\Software\Policies\Google\Chrome\
3. If the BlockThirdPartyCookies value name does not exist or its value data is not set to 1, then this is a finding.

Fix Text (F-0015r1_fix)
Valid for Chrome Browser version 10 or later. Windows registry: Key Path: HKLM\Software\Policies\Google\Chrome\ Value Name: BlockThirdPartyCookies Value Type: Boolean (REG_DWORD) Value Data: 1 Windows group policy: Policy Path: Computer Configuration\Administrative Templates\Google\Google Chrome\ Policy Name: Block third party cookies Policy State: Enabled Policy Value: N/A