SOLVED Secure cookies & X-Frame-Options
luckow last edited by
To get 100 points with https://siwecos.de/en/, I need two more options. Do you have any idea how to set the following options in Surfer?
- secure cookies: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
@nebulon Also while X-Frame-Options is not as current as CSP, it's still considered best practice to get more complete coverage for that protection across browsers, especially older ones:
At least, that's still the case for every audit and best practice list in the circles I'm in. It is still required by the latest ASVS 4.0.2 (criteria 14.4.7) as well (source: en / de). So I'd encourage both. While you're touching the session cookie, you can also probably go SameSite=Strict as well.
I've published a new app package which now has strict and secure cookies.
Regarding the X-Frame-Options, we used to have that in the platform but decided against supporting it, due to the overlap with CSP and thus having caused inconsistency and confusion depending on what the app sets on its own.
scooke last edited by