Summary

Pega-RULES cookie is not httponly. Cookies with out "HTTPOnly" attribute are permitted to be accessed via JavaScript Cross-site scripting attacks can steal to session cookies which could lead to user impersonation or compromise of the application account. 

Error Messages

Not Applicable

Steps to Reproduce

Not Applicable

Root Cause

Not Applicable

Resolution

Perform the following local-change steps:

1. Add the below DSS/prconfig to the make set-cookie attribute to httponly for Pega-RULES cookie:

DSS: purpose - prconfig/cookie/httponly/default (default can vary based on node classification)
         Ruleset  - Pega-Engine
         Value     - true

prconfig.xml   <env name="cookie/httponly" value ="true"/>

2. Restart the server after this DSS/prconfig is set.