How to fix Session Cookie attributes not set application hosted in web app ?

Question

How to remediate the issue or vulnerability of Session Cookie attributes not being set when the application is hosted in an Azure web app behind the Azure Application Gateway with WAF ?

Answer 1

Hi @$@chin ,

welcome to the Microsoft Q&A Platform!
To remediate the vulnerability related to session cookies without secure attributes in an Azure Web App behind an Application Gateway with WAF,

• Set Cookie Attributes in Code: Configure session cookies with Secure, HttpOnly, and SameSite attributes in the application code.

var cookieOptions = new CookieOptions
{
    Secure = true,        // Only send over HTTPS
    HttpOnly = true,      // Prevent access from JavaScript
    SameSite = SameSiteMode.Strict  // Set cross-site restriction
};

• Web.Config Settings (for .NET): Set cookies to require SSL and specify cookieSecure="Always" in web.config.

<system.web>
    <authentication mode="Forms">
        <forms requireSSL="true" cookieless="UseCookies" />
    </authentication>
    <sessionState cookieSecure="Always" />
</system.web>

• Use Azure Application Gateway Rewrite Rules: Create rewrite rules in Application Gateway to add Secure, HttpOnly, and SameSite attributes if they are missing.
• Enable HTTPS-Only in Azure Web App: Go to TLS/SSL settings and enable HTTPS Only.
• Verify with Security Tools: Confirm session cookies have secure attributes using browser dev tools or a vulnerability scanner.
  It help secure session cookies and reduce vulnerability.
  If the answer is helpful, please click "Accept Answer" and kindly upvote it.