[JSWSERVER-16322] Missing Secure Attribute in Encrypted Session Cookie

Feedback Policy:

We collect Jira feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

Hi Atlassian Team,

we had a Pentest and would like to know how to deal with the following results and what type of Support we can have (if any) from Atlassian in here:

Application Error forging a request that contains parameters or parameter values other than the ones expected by the application	Check incoming requests for the presence of all expected parameters and values.	http://cwe.mitre.org/data/definitions/550.html
Missing Secure Attribute in Encrypted Session Cookie	Basically the only required attribute for the cookie is the "name" field. Common optional attributes are: "comment", "domain", "path", etc. The "secure" attribute must be set accordingly in order to prevent to cookie from being sent unencrypted. RFC 2965 states: "The Secure attribute (with no value) directs the user agent to use only (unspecified) secure means to contact the origin server whenever it sends back this cookie, to protect the confidentially and authenticity of the information in the cookie." For further reference please see the HTTP State Management Mechanism RFC 2965 at: http://www.ietf.org/rfc/rfc2965.txt and for "Best current practice" for use of HTTP State Management please see http://tools.ietf.org/html/rfc2964	CWE-522 http://cwe.mitre.org/data/definitions/522.html, CWE-718 http://cwe.mitre.org/data/definitions/718.html, CWE-724 http://cwe.mitre.org/data/definitions/724.html, CWE-928 http://cwe.mitre.org/data/definitions/928.html, CWE-930 http://cwe.mitre.org/data/definitions/930.html, PCIDSS-6.5.10

Jira Software Data Center