Question

在正在开发的网站上运行Qualys漏洞扫描时，我遇到了以下漏洞：

Cookie Does Not Contain The "HTTPOnly" Attribute

Cookie Does Not Contain The "secure" Attribute

我的应用程序在ExpressJS，NodeJS和nginx Web服务器中运行。我正在使用express-session和csurf令牌。我已经设置了HTTPOnly和secure标志true。配置如下：

app.use(bodyParser.json({limit: '50mb'}));
app.use(bodyParser.urlencoded({extended: false, limit: '50mb'}));
app.use(cookieParser());

app.use(express.static(path.join(__dirname, "/../public")));

app.enable("trust proxy");
app.use(expressSession({
    store: new MongoStore({
        url: `session_db`
    }),
    secret: `session_secret`,
    resave: true,
    saveUninitialized: true,
    proxy: true,
    rolling: true,
    cookie: {
        secure: true,
        httpOnly: false,
        maxAge: (72 * 60 * 60 * 1000)
    },
    unset: "destroy"
}));

app.use(passport.initialize());
app.use(passport.session());

app.use(flash());

app.use("/api", api);

app.use( csrf({
    cookie: {
        secure: true,
        httpOnly: true
    }
}));//csrf

我的nginx配置是：

 location / {
                proxy_pass http://nodejs;
                proxy_set_header Host $host ;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto https;
                proxy_cookie_path / "/; HTTPOnly; Secure";
        }

HTTPOnly和secure这两个标志都在浏览器cookie部分中被打勾。但是当我扫描它时，它向我显示了上述漏洞。

有人可以帮我吗？

等待您的帮助朋友

Cookie不包含“安全”和“ HTTPOnly”属性

0 个答案: