UCF STIG Viewer Logo

tc Server HORIZON must perform server-side session management.


Overview

Finding ID Version Rule ID IA Controls Severity
V-240734 VRAU-TC-000050 SV-240734r673946_rule Medium
Description
Cookies are a common way to save session state over the HTTP(S) protocol. If an attacker can compromise session data stored in a cookie, they are better able to launch an attack against the server and its applications. Session cookies stored on the server are more secure than cookies stored on the client. Therefore, tc Server must be configured correctly in order to generate and manage session cookies on the server. Managing cookies on the server provides a layer of defense to vRealize Automation. By default, tc Server is designed to manage cookies on the server. However, incorrect configuration can turn off the default feature.
STIG Date
VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide 2021-06-23

Details

Check Text ( C-43967r673944_chk )
At the command prompt, execute the following command:

grep -E 'cookies=.false' /opt/vmware/horizon/workspace/conf/context.xml

If the command produces any output, this is a finding.
Fix Text (F-43926r673945_fix)
Navigate to and open /opt/vmware/horizon/workspace/conf/context.xml.

Navigate to and locate the node.

Remove the value 'cookies="false"' from the node.