2.7.1 Setting up Secure Flag for Cookies

If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic.

Below configuration has to be ensured in weblogic.xml within the deployed application ear.

1. Cookie secure flag set to true

   <wls:session-descriptor>

   <wls:cookie-secure>true</wls:cookie-secure>

   <wls:url-rewriting-enabled>false</wls:url-rewriting-enabled>

   </wls:session-descriptor>

Always make sure Cookies are set with always Auth Flag enabled by default for WebLogic server and also recommended to apply the weblogic patch 10.3.5 for versions using below weblogic 10.3.5 to reflect the above changes.