Just wanted to list a couple of security concerns found when scanning my Splynx installation for security holes.
1. Threat:
The cookie does not contain the “secure” attribute.
Impact:
Cookies with the “secure” attribute are only permitted to be sent via HTTPS. Cookies sent via HTTP expose an unsuspecting user to sniffing attacks that could lead to user impersonation or compromise of the application account.
Solution:
If the associated risk of a compromised account is high, apply the “secure” attribute to cookies and force all sensitive requests to be sent via HTTPS.
2. Threat:
The cookie does not contain the “HTTPOnly” attribute.
Impact:
Cookies without the “HTTPOnly” attribute are permitted to be accessed via JavaScript. Cross-site scripting attacks can steal cookies which could lead to user impersonation or compromise of the application account.
Solution:
If the associated risk of a compromised account is high, apply the “HTTPOnly” attribute to cookies.
Researching how to do this it seems it might be something that needs to be implemented at the Splynx code level.