Setting the secure flag on cookies from Outlook Web Access

Posted by Cheekysoft on Server Fault See other posts from Server Fault or by Cheekysoft
Published on 2012-06-26T12:39:02Z Indexed on 2012/06/26 15:18 UTC
Read the original article Hit count: 239

Filed under:

security

|

exchange-2007

|

cookies

|

outlook-web-access

I'm running Exchange 2007 SP3 which is exposing outlook web access over only HTTPS. However the server delivers the sessionid cookie without the secure flag set. Even though I don't have port 80 open, this cookie is still vulnerable to being stolen over port 80 in the event of a man-in-the-middle attack. It also contributes to a PCI-DSS failure

Does anyone know if I can persuade the web server/application to set the secure flag?

© Server Fault or respective owner

Related posts about security

sudo apt-get update errors

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Here is what I get on my terminal when running sudo apt-get update errors. I dont know if the issue is from my sources.list or my proxy setup(have not made any changes to proxies). Thank you for any help in advanced. Ign http://security.ubuntu.com oneiric-security Release.gpg Ign http://security… >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Devx - Search for 'Devx'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
The Security-Developer Gap: Why IT Security Can't Fix Your Security Problems Alone

as seen on Internet.com - Search for 'Internet.com'
Two well-known white hats explain how hackers take advantage of security holes left by enterprise application developers. >>> More
StackOverFlowError while creating Mac object on AS400/Java

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello all, I am a newbie to AS400-Java programming. I am trying to create my first program to test the implementation of Message Authentication Code (MAC). I am trying to use the HMACSHA1 hash function. My (Java 1.4) program runs fine on a dev box (V5R4).But fails terribly on the QA box (V5R3). My… >>> More
Google App Engine - Spring Security Issue (java.security.AccessControlException)

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm currently getting the AccessControlException below when I deploy to app engine (I don't see it when I run in my local environment). I'm using GAE 1.3.1, Spring 3.0.1, and Spring Security 3.0.2. Any ideas how to get around this issue? It appears to be an issue with Spring Security trying to get… >>> More

Related posts about exchange-2007

when using exchange 2010 it complains of not talking to Information Store service on exchange 2007

as seen on Server Fault - Search for 'Server Fault'
I am attempting to do an upgrade in my org from exchange 2007 to exchange 2010. I moved all the mailboxes and made sure my certificates were setup in exchange 2010. I then changed my ip forwarding rules to forward mail to my exchange 2010 box. I can receive email. I then powered off my exchange 2007… >>> More
Disk I/O error copying a Exchange 2007 database

as seen on Server Fault - Search for 'Server Fault'
Hi all, A short time ago due to disk space I moved our Exchange database onto an external drive, the drive was new and the database was being backed up daily. I've now discovered the database is corrupt, I've run the Exchange utils to fix the database and this works but it corrupts again as soon… >>> More
Do I have to prepare Active Directory prior to installing an Exchange service pack?

as seen on Server Fault - Search for 'Server Fault'
I'm having trouble determining the proper procedure for installing Exchange 2007 sp3 on a Server 2008 R2 box running Exchange 2007 sp1. It is not clear on websites I have consulted (Microsoft TechNet and others) whether preparing Active Directory is only required on a NEW install of Exchange 2007… >>> More
Exchange 2007 Owa (OnlineVersion) can not authenticate

as seen on Server Fault - Search for 'Server Fault'
Exchange Authentication dll: https://red002.mail.emea.microsoftonline.com/owa/auth/owaauth.dll sending style is: request.Method = "POST"; request.ContentType = "application/x-www-form-urlencoded"; And sending following message destination=https://red002.mail.emea.microsoftonline.com/owa/testuser@xxxserver… >>> More
Issues with doing a P2V on Exchange 2007

as seen on Server Fault - Search for 'Server Fault'
I shutdown all Exchange services on the physical box and did a convert. Everything converted fine. Server booted up no issues and I could receive email from the outside world with no issues. But I am unable to send emails internally or externally. They just sit in the Outbox. I also disabled the… >>> More