Forum Discussion
Brian_Achenbaugh
Cirrus
CirrusCookies, jsessionid and encryption
Hi All, Im relatively new to this. Our company had a third party do a pentest on our External apps in a DMZ. We had one call out for cookie information disclosure, so we turned on cookie encryption...
Maybe add the solution if others are experiencing the same?
Brian_AchenbaughCirrus
CirrusSo based on the info in this article:
The person wanted to actually insert load balancing info into the universal persistence cookie as it wasnt there, so that sort of cleared my concern that it would be exposed like in a normal load balancing cookie. Im hoping my assumption was correct.