### Discussion ###
When used in production, Horizon should have the Secure Attribute for cookies set. When this flag is set, browsers will only transfer the cookie over secure channels. Without it set, browsers may transfer the cookie over plain-text channels, potentially exposing the contents to an attacker who can then use the cookie to authenticate with the Horizon server as the original user.
Horizon does not set Secure Attribute in cookies
-----
### Summary ###
Horizon does not, by default, set the Secure Attribute in cookies
### Affected Services / Software ###
Horizon, Django
### Discussion ###
When used in production, Horizon should have the Secure Attribute for cookies set. When this flag is set, browsers will only transfer the cookie over secure channels. Without it set, browsers may transfer the cookie over plain-text channels, potentially exposing the contents to an attacker who can then use the cookie to authenticate with the Horizon server as the original user.
### Recommended Actions ### COOKIE_ SECURE config flag to true: /docs.djangopro ject.com/ en/dev/ ref/settings/ #std:setting- SESSION_ COOKIE_ SECURE
Enable secure cookie by setting the SESSION_
https:/
### Contacts / References ### /bugs.launchpad .net/ossn/ +bug/1191051 /bugs.launchpad .net/ossn/ +bug/1191050 /launchpad. net/~openstack- ossg
This OSSN : https:/
Related Horizon/Django OSSN : https:/
OpenStack Security ML : openstack-security at lists.openstack.org
OpenStack Security Group : https:/