SA-3279

Summary

Session Identifier Not Updated 

Error Messages

NA

Steps to Reproduce

Run AppScan Report

Root Cause

The root cause of this problem is a defect in Pegasystems’ code/rules. 

It is possible to steal or manipulate customer session and cookies, which might be used to impersonate a legitimate user, 
allowing the hacker to view or alter user records, and to perform transactions as that user

Resolution

This issue is resolved by hotfix item HFix-9896
Added support for HttpOnly. As the HFix contains a change to status.jsp

HFix-2290
with new portable encryption spec enabled in 5.5 GA and up, the base64-encoded string used for a pre-authentication cookie is now slightly longer than 70 characters, which caused the base64util class to add a line break near the end.  Cookies with line breaks violate the http spec because it ruins header parsing.
Added below parameter to prconfgi.xml
<env name="authentication/UsePreAuthenticationCookie" value="true"/>