SA-16473

Summary

Login screen does not display Pega 7 icon. This issue occurs after the below security changes are performed in prconfig file. 

<env name="cookie/HttpOnly" value="true" /> 
<env name="HTTP/SetSecureCookie" value="true"/> 

Login image is not displayed when SetSecureCookie and HTTPOnly are enabled and the system is access through SSL.

Error Messages

Not Applicable

Steps to Reproduce

Enable setsecurecookie and httponly while accessing system through SSL. Observe that the login screen does not load the display image.

Root Cause

The root cause of this issue is a bug that exists when attempting to load login screen through SSL with these two settings in place. 
Apart from Pega logo, other static content requests made before user logs in are returned with response code as 304. In StaticContentClient class at time of retrieval of file (in retrieveFile() method) cookies are obtained from HttpServletResponse using getCookies() which does not return Pega-RULES cookie even though the header cookie has Pega-RULES.

Resolution

Apply HFix-24749.