2507150 - Cannot set HttpOnly for PortalAlias and SAPWP_active cookies

• PortalAlias and SAPWP_active are cookies set by the Netweaver Application server that do not have 'HttpOnly' attribute. This may have been hightlighted during a vulnerability scan for example.
• You would like to ensure that these cookies are set with 'HttpOnly' attribute.
• There are no properties available that can be configured to set HttpOnly for the cookies.

Read more...

• EP Release Independent
• SAP NetWeaver
• SAP Composition Environment

SAP Composition Environment all versions ; SAP NetWeaver 2004 ; SAP NetWeaver 7.0 ; SAP NetWeaver 7.1 ; SAP NetWeaver 7.2 ; SAP NetWeaver 7.3 ; SAP NetWeaver 7.4 ; SAP NetWeaver 7.5 ; SAP enhancement package 1 for SAP NetWeaver 7.0 ; SAP enhancement package 1 for SAP NetWeaver 7.3 ; SAP enhancement package 2 for SAP NetWeaver 7.0

Enterprise Portal 7.0, EP 7.0, Enterprise Portal 7.01, EP 7.01, Enterprise Portal 7.02, EP 7.02, Enterprise Portal 7.03, EP 7.03, Enterprise Portal 7.1, EP 7.1, Enterprise Portal 7.2, EP 7.2, Enterprise Portal 7.30, EP 7.30, Enterprise Portal 7.31, EP 7.31, Enterprise Portal 7.40, EP 7.4, Enterprise Portal 7.50, EP 7.5, SAPWP_active_Enforce_Secure_Cookie, portal.alias.security.enforce_secure_cookie, flag, JSESSIONID/JSESSIONMARKID/saplb_ , KBA , EP-PIN-AI , Application Integration , BC-JAS-SEC , Security, User Management , Problem