Secure flag is showing set but we are still getting "cookie without secure flag" in zap report

[Amit Kumar]

HI All,

while checking manually in browser Cookies are set as secure.

If i will running owasp ZAP on the same url .In ZAP html report it gives error that "cookie without secure flag".

Please help me to understand it.

Thanks

Amit

[thc...@gmail.com]

Hi.

Is the secure flag present in the Set-Cookie header of that message?

Best regards.

[Amit Kumar]

please check this Screenshot.

[Amit Kumar]

Hey,

Yes, secure flag is present in the Set-Cookie header.

Please give ans if you have any suggestion about it.

On Wednesday, June 20, 2018 at 5:17:24 PM UTC+5:30, thc202 wrote:

[thc...@gmail.com]

Hi.

Could you check in ZAP instead? Specifically the message that's
associated with the alert? (That's what ZAP used to raise the alert.)

Best regards.

[Amit Kumar]

hi,

i have checked in zap ,please refer the attached image.

​thanks

--
You received this message because you are subscribed to a topic in the Google Groups "OWASP ZAP User Group" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/zaproxy-users/WCLFZJe9A0A/unsubscribe.
To unsubscribe from this group and all its topics, send an email to zaproxy-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/df581f5a-ab1a-287a-860e-1ce4258c474d%40gmail.com.

For more options, visit https://groups.google.com/d/optout.

--

Thanks and Regards,

Amit Kumar

906000306

[thc...@gmail.com]

Hi.

Could you check the whole Set-Cookie header in the Response tab?

Best regards.

On 21/06/18 14:32, Amit Kumar wrote:
> hi,
>
> i have checked in zap ,please refer the attached image.
>
>

>> zaproxy-user...@googlegroups.com.

[Amit Kumar]

please check.

[kingthorin+owaspzap]

Can you confirm, you selected the alert (not something in the Sites Tree or History) and then the response tab?

I'm totally unable to recreate the issue you're having.

[Amit Kumar]

Yes.. i was selected the alert.

On Wed, Jun 27, 2018 at 1:18 AM, kingthorin+owaspzap <kingt...@gmail.com> wrote:

Can you confirm, you selected the alert (not something in the Sites Tree or History) and then the response tab?

I'm totally unable to recreate the issue you're having.

--

You received this message because you are subscribed to a topic in the Google Groups "OWASP ZAP User Group" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/zaproxy-users/WCLFZJe9A0A/unsubscribe.

To unsubscribe from this group and all its topics, send an email to zaproxy-users+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/4fee8c0d-7da4-454f-a8fc-fa3868b24102%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[thc...@gmail.com]

Which versions of ZAP and passive scanner rules add-on did you use?

Best regards

[Amit Kumar]

zap version is 2.6.0

Passive scanner rules-2.4.0

--
You received this message because you are subscribed to a topic in the Google Groups "OWASP ZAP User Group" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/zaproxy-users/WCLFZJe9A0A/unsubscribe.
To unsubscribe from this group and all its topics, send an email to zaproxy-users+unsubscribe@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/15303275-5991-a8bb-458f-a59882eeb0f4%40gmail.com.

For more options, visit https://groups.google.com/d/optout.

[kingthorin+owaspzap]

1) You should upgrade to 2.7.0
2) 2.4.0 doesn’t make sense. https://github.com/zaproxy/zaproxy/wiki/FAQAddonVersions

[Amit Kumar]

sorry,

Passive scanner rules version ->20

On Thu, Jun 28, 2018 at 2:29 AM, kingthorin+owaspzap <kingt...@gmail.com> wrote:

1) You should upgrade to 2.7.0
2) 2.4.0 doesn’t make sense. https://github.com/zaproxy/zaproxy/wiki/FAQAddonVersions

--
You received this message because you are subscribed to a topic in the Google Groups "OWASP ZAP User Group" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/zaproxy-users/WCLFZJe9A0A/unsubscribe.
To unsubscribe from this group and all its topics, send an email to zaproxy-users+unsubscribe@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/c7467eec-0aa5-4c87-92aa-3962266443c1%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[kingthorin+owaspzap]

You need to upgrade both components.

https://github.com/zaproxy/zap-extensions/releases

[Amit Kumar]

hi 

i have upgraded both components version o f zap is 2.7.0 and passive scan rule is 22.

but if i put active scan on any url, it is showing 100% complete within 1 sec.(now not able to scan)

[kingthorin+owaspzap]

That's completely separate from your original issue. Passive scanning and active scanning are seperate.

After spidering/browsing the same content has your cookie issue been resolved?

[Amit Kumar]

HI,

That's the different issue i will resolved that.

My main issue is when i am selecting the particular URL from History then response tab Secure Flag is present.
But when i am selecting Alert then Response tab Secure flag is not present.

On Thu, Jun 28, 2018 at 11:04 PM, kingthorin+owaspzap <kingt...@gmail.com> wrote:

That's completely separate from your original issue. Passive scanning and active scanning are seperate.

After spidering/browsing the same content has your cookie issue been resolved?

--
You received this message because you are subscribed to a topic in the Google Groups "OWASP ZAP User Group" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/zaproxy-users/WCLFZJe9A0A/unsubscribe.
To unsubscribe from this group and all its topics, send an email to zaproxy-users+unsubscribe@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/zaproxy-users/4d2a7b09-3806-4204-b9c5-5d735e638c4c%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[kingthorin+owaspzap]

Cool so now you know that ZAP is indeed encountering the cookie as described. You just have to unwind the difference in the requests and address why your app/server is handling the two requests differently.